aes-128 encrypted m3u8 stream (nagra)

[WEvga566]

I have a m3u8 that redirects to the next one which contains the fragments

#EXTM3U
#-----------------------------------------------------------
#--Created with VSPP Streamer version 10.4.0.0 build  Commit_id: a79e8e69252cba6a97f0838ddc6fdec396332a18 Commit_time: 1728995528 context KOGCKJCAONIEPLKG-IIMNMAAAONIEPLKG
#-----------------------------------------------------------
#EXT-X-VERSION:3
#EXT-X-STREAM-INF:PROGRAM-ID=1,BANDWIDTH=1300000,RESOLUTION=640x360
index.m3u8/S!d2ELUExBWURSTUxJVkUSBlT-....ARYMnw__/Level(1300000)?start=LIVE&end=END

when sending a GET to the url with the added portion, i get this output

HTTP/1.1 200 OK
Etag: "75140504-1790923346470-LIVE"
Last-Modified: Fri, 02 Oct 2026 06:42:26 GMT
Session-Id: KOGCKJCAONIEPLKG
Server: MediaKind VSPP Streamer (Version: 10.4.0.0 Commit_id: a79e8e69252cba6a97f0838ddc6fdec396332a18 Commit_time: 1728995528)
Content-Length: 152222
Content-Type: application/vnd.apple.mpegurl
Date: Fri, 02 Oct 2026 06:42:31 GMT
Vary: accept-encoding
Cache-Control: public,max-age=1
X-Varnish: 92238926
X-Varnish: 328629341
X-Varnish: 786790073
Age: 0
Via: 1.1 pta1-stor3, 1.1 hfa1-vspp-proxy01, 1.1 hfa1-cdn-middle-live00, 1.1 hfa1-xdn-edge-live01
Access-Control-Allow-Methods: GET, OPTIONS, HEAD
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: Range
Accept-Ranges: bytes
Connection: keep-alive

#EXTM3U
#-----------------------------------------------------------
#--Created with VSPP Streamer version 10.4.0.0 build  Commit_id: a79e8e69252cba6a97f0838ddc6fdec396332a18 Commit_time: 1728995528 context KOGCKJCAONIEPLKG-IIMNMAAAONIEPLKG
#-----------------------------------------------------------
#EXT-X-VERSION:3
#EXT-X-TARGETDURATION:6
#EXT-X-PROGRAM-DATE-TIME:2026-10-02T05:42:07.391Z
#EXT-X-MEDIA-SEQUENCE:527633
#EXT-X-KEY:METHOD=AES-128,URI="http://www.nagra.com/key=20597&prm=eyJjb250ZW50SWQiOiIyMDU5NyIsImtleUlkIjoiOWM0NjQ0NTgtZmQ0YS00ZTM3LThjNjEtNDJmZTVlYTY4M2Y5In0",IV=0x0000000000000000EE51B9ED51A03F00
#EXTINF:6,
Level(1300000)/Segment(17909197273911790).ts
#EXT-X-KEY:METHOD=AES-128,URI="http://www.nagra.com/key=20597&prm=eyJjb250ZW50SWQiOiIyMDU5NyIsImtleUlkIjoiOWM0NjQ0NTgtZmQ0YS00ZTM3LThjNjEtNDJmZTVlYTY4M2Y5In0",IV=0x0000000000000000EED84CF151A03F00
#EXTINF:6,

when trying to ffmpeg the m3u8 i get access forbidden, i have a cert.pem and a private key which is a certificate invoked by the android application registered device inside pak.db, how can i ffmpeg without getting forbidden access to the nagra uri?

[LZAA]

Url?