diff --git a/libwvdrmengine/cdm/core/src/device_files.proto b/libwvdrmengine/cdm/core/src/device_files.proto
index 3d743525..25956ee0 100644
--- a/libwvdrmengine/cdm/core/src/device_files.proto
+++ b/libwvdrmengine/cdm/core/src/device_files.proto
@@ -28,6 +28,15 @@ message DeviceCertificate {
   optional bytes certificate = 1;
   optional bytes wrapped_private_key = 2;
   optional PrivateKeyType key_type = 3 [default = RSA];
+  // Used by DRM certificates with an expiry time. Set by the client when
+  // the certificate is received. Aids expiration calculation at the
+  // client when provisioning server and client clocks are not aligned
+  optional int64 acquisition_time_seconds = 4;
+  // Used by DRM certificates without an expiration time. This is for
+  // upgrading devices with pre-existing DRM certificates. The client will
+  // calculate an expiration time 6 months into the future with a randomized
+  // +/-2 month window
+  optional int64 expiration_time_seconds = 5;
 }
 
 message License {
@@ -56,6 +65,7 @@ message License {
   optional int64 grace_period_end_time = 11 [default = 0];
   optional bytes usage_entry = 12;
   optional int64 usage_entry_number = 13;
+  optional DeviceCertificate drm_certificate = 14;
 }
 
 message UsageInfo {
@@ -68,9 +78,19 @@ message UsageInfo {
     optional bytes key_set_id = 4;
     optional bytes usage_entry = 5;
     optional int64 usage_entry_number = 6;
+    // If not present, use the legacy DRM certificate rather than
+    // one in DrmDeviceCertificate
+    optional int32 drm_certificate_entry_number = 7;
+  }
+
+  // A cache of DeviceCertificates associated with usage entries
+  message DrmDeviceCertificate {
+    optional int32 drm_certificate_entry_number = 1;
+    optional DeviceCertificate drm_certificate = 2;
   }
 
   repeated ProviderSession sessions = 1;
+  repeated DrmDeviceCertificate drm_device_certificates = 2;
 }
 
 message HlsAttributes {
@@ -92,7 +112,7 @@ message UsageTableInfo {
 
     optional UsageEntryStorage storage = 1;
     optional bytes key_set_id = 2;
-    optional bytes usage_info_file_name = 3; // hash of the app_id
+    optional bytes usage_info_file_name = 3;  // hash of the app_id
 
     // LRU table replacement data.
     optional int64 last_use_time = 4 [default = 0];
@@ -114,9 +134,7 @@ message File {
     USAGE_TABLE_INFO = 5;
   }
 
-  enum FileVersion {
-    VERSION_1 = 1;
-  }
+  enum FileVersion { VERSION_1 = 1; }
 
   optional FileType type = 1;
   optional FileVersion version = 2 [default = VERSION_1];