Hash of CPL in the PKL checks out (after converting to Unix line endings).

Carsten sees this too.

Here are the two encrypted DCPs, one created with 2.14.57, one with 2.15.171

https://www.dropbox.com/s/vswp0ds8yw3lysc/SMPTEEncrypted_TST-1_F-178_DE-XX_MOS_2K_20220203_SMPTE_OV.zip?dl=0

https://www.dropbox.com/s/9kfy1648yexzdcz/SMPTEEnc215171_TST-1_F-178_DE-XX_DE-NR_MOS_2K_20220203_SMPTE_OV.zip?dl=0

Will do another one with the latest test version later.

Same problem with 2.16.0

I guess the first thing might be to hack 2.15.x / 2.16.0 to remove <MainMarkers> and the CPL metadata to see if that helps.

https://dcpomatic.com/forum/viewtopic.php?f=2&amp;t=1794

Carsten tracked this down to something different in the certificates that are made between 2.15.36 and 2.15.37.

Two things happened here that might be important:

• started using our own bundled openssl to make certs that start a week before now.
• bumped the validity period to 40 years.

The 40 years thing takes end dates past 2050, at which point according to SMPTE 430-2-2006 we should use GENERALIZEDTIME rather than UTCTIME to store the validity dates. It looks like OpenSSL already does this correctly, but perhaps that is tripping up Barco's check?

Maybe something is wrong with the change to make certs start early.

Will make a version which backs off the validity period to 25 years.

Checked a random Fraunhofer cert and it is valid:
Not Before: Jun 21 09:26:05 2011 GMT
Not After : Jun 14 09:26:05 2036 GMT
i.e. just less than 25 years.

Reducing DoM's cert validity length to 25 years fixes it on the Barco, but not on the Sony (one of the builds on 2174-cert-duration)

Dropping back to 10 years works on the Sony (another build on2174-cert-duration) ...and yet 2.14.x uses 40-year certs and works fine (
-- later: 2.14.x does use 40-year certs but we were testing with 10-year certs made by a previous version.

2174-no-shipped-openssl checks the other change (bundling openssl). Appears to make no difference.

On catalina

% openssl version
LibreSSL 2.8.3

Can't see anything significant comparing certs created on Catalina from 2.14.57 and 2.15.37. Seems like it must be either something else in 2.15.37, or some other bug that happens to be exposed by using longer certificate validity.

Looks like in fact it is simply the 40 year validity that causes problems. 9bda3fda70912d73266a2dbac5470ca23d2ff6fd goes back to 10-year periods, and 3e6b2d886961177c8d89b3f9168393d33c13bff2 warns on startup if the signer certs have a long validity period.

Similar things are added to 2.14.58.

Tested and working in 2.14.59.