Answer: You see the message 'Video cannot be decrypted' in a video tile if the server hosting the Media Gateway role lacks the appropriate certificate with the private key needed to decode the encrypted video.
Cause
Security Center uses fusion stream encryption, a type of asymmetric encryption, to protect sensitive video content. The video is encrypted using the public key linked to the certificate that identifies a client application. In this case, the client application is the Media Gateway role. The Media Gateway role must have the same certificate with the corresponding private key to decode the video. Multiple servers can be assigned to host the Media Gateway role. The Media Gateway role assigns video requests to its servers in a round-robin fashion. If a video request is processed on a server that doesn't have the certificate installed, you will receive this error message. For more information, see How does fusion stream encryption work?
Solution
Ensure that all required certificates are installed on all servers hosting the Media Gateway role.