Encrypted DCPs and KDMs on a Windows PC

What you need

NeoDCP Player plays encrypted DCPs with KDMs issued to the player’s certificate. To play an encrypted DCP on a PC, you need four things:

• A Cinema or Cinema PT license. It includes the player certificate that content providers need to issue KDMs for your player.
• A 64-bit Windows 10 or 11 PC with a graphics card, cable and projector or display that support HDCP (HDMI) or DisplayPort Content Protection (DPCP).
• The encrypted DCP, on its delivery drive or already copied to the PC.
• A KDM issued to your player’s certificate by the content provider, valid for your screening dates.

How the key reaches the screen

1. 1Send the certificateYou send the certificate chain (.pem) to the content provider.
2. 2Get the KDMThe provider issues it for your certificate, the CPL and your dates.
3. 3Ingest the KDMThe player keeps it in its KDM database.
4. 4Play over HDCP or DPCPEvery link to the screen is protected.

1. Send the player’s certificate

Each Cinema and Cinema PT installation has its own digital certificate. It comes with your license: the license email contains the player certificate (.cert.sha256.pem) and its certificate chain (.chain.sha256.pem).

Send the certificate chain file (.chain.sha256.pem) to the distributor, lab or festival that provides the DCP, together with your screening dates. Most content providers ask for this file. It contains three certificates: your player’s certificate, the NeoDCP Player Intermediate Certification Authority certificate and the NeoDCP Root Certification Authority certificate.

Some distributors also ask for the player’s make, model and serial number. You find them in your license email.

The certificate belongs to this installation. Send the new one to your content providers when it changes, because the next KDMs must be issued for it:

• after a Windows reinstall, or when a Windows System Restore or upgrade invalidates the license key; the license key and certificate are re-issued free of charge (FAQ);
• after a license transfer to a new PC;
• when you request new license files for the CA certificates introduced in September 2025 (what changed).

2. Get the KDM

A KDM (Key Delivery Message) carries the keys for one encrypted composition. The content provider issues it for three things: your player’s certificate, the CPL you will play and a validity period. The KDM opens the DCP only on the player it was issued to, and only within that period.

Ask for KDMs well before the screening. Tell the provider your screening dates and the time zone of the venue, and check every KDM you receive against the screening times in local time.

A KDM belongs to one CPL. If you play several versions of a film, for example with other subtitles, or a Supplemental DCP (VF), ask for a KDM for each CPL you will play.

3. Ingest the KDM

1. Click Ingest KDM in the controller window and choose the KDM file. KDMs can be ingested while you preview a DCP.
2. The player keeps the KDM in its KDM database, which is stored in encrypted form, so the DCP can be played again without loading the KDM again.
3. Check the validity in the KDM browser. It shows the validity period of every key in local time and in UTC, with its KDM message ID, and marks keys that are valid, expire soon, have expired or become valid later.
4. Open the DCP with File › Open DCP… or from your DCP library, and start playback.

Inspect DCP shows which ingested keys belong to a DCP and when they expire. In the KDM browser you can filter the list and remove expired keys, selected keys or single validity periods.

4. Use a protected connection

NeoDCP Player plays encrypted content only over a protected connection: HDMI with HDCP or DisplayPort with DisplayPort Content Protection (DPCP). Set the output to an HDCP- or DPCP-capable display or projector and start the encrypted DCP; the output is protected automatically.

Encrypted content can’t be exported from the player. Unencrypted DCPs can also reach other equipment, for example SDI devices through the graphics card’s HDMI output and an HDMI-to-SDI converter (FAQ).

5. Check before the show

Play every encrypted title on the screening PC, with the projector and the KDMs you will use, before the audience arrives.

For labs and distributors

NeoDCP Player plays SMPTE and Interop DCPs, including encrypted DCPs with KDMs issued to the player’s certificate. To issue KDMs for a venue that uses it:

• Ask the venue for the certificate chain file (.chain.sha256.pem) from its license email. It contains the player certificate, the NeoDCP Player Intermediate Certification Authority certificate and the NeoDCP Root Certification Authority certificate. Each installation has its own, so a venue with a backup PC sends one for each PC.
• Take the NeoDCP Root CA certificate from a trusted source, not only from the chain file. The NeoDCP CA certificates, introduced in September 2025, are on the download page after a free registration.
• Issue the KDM for the player certificate, the CPL the venue will play and the screening dates.

Next steps

Encrypted DCPs with KDMs play with the Cinema license (1 year) and the Cinema PT license (no expiry date).

Test the PC with your unencrypted DCPs first: download the 14-day trial. Questions about KDMs or certificates? Ask the developer.

More step-by-step help is in the NeoDCP Player guides, for example Set up a Windows PC for DCP screenings. The features page describes the KDM database and the protected output, and the FAQ answers common questions about licenses and KDMs.