It is recommended that the key rules of the license issued by the license server include client security level requirements, output rules, and any one or more consumption rules.

The DRM license server should regularly access OCSP services and CRL services. The DRM server should query the status of the device certificate before issuing a license. The status of the device certificate can be obtained through the CRL provided by the DTA. The DRM license service shall check the validity period of the DRM client certificate and its superior (parent) certificate carried in the license request message before issuing a license. If the validity period of any certificate exceeds the validity period, it shall refuse to issue license.

The DRM client may judge the status of the server certificate before using the license. The real-time status of the DRM server certificate can be obtained by querying the OCSP response from the OCSP server.

To ensure compatibility, the DRM license service should be able to support the "contentIDs" with the array structure of PSSH base64 string or CID base64 string.