About this service
This service issues signed software licenses and answers whether a license is still good.
A license is a signed document a product keeps. It can be checked in three independent ways, so a product can confirm a license is valid even when part of the system is unreachable.
How verification works
- Offline verification A product verifies the license signature itself, against trust anchors it pinned or fetched from the trust bundle. No network is needed; revocation is not visible this way.
- API-based verification A product sends the license to the validation API, which checks revocation and usage limits and returns a short-lived signed token the product may rely on until it expires.
- DNS-based verification A product looks up a hashed license label in a DNSSEC-signed zone. The TXT record is the answer: valid, revoked or expired, as fresh as its TTL, and it works when the API does not.
This deployment
- /api Validation API Validation, activation and heartbeat. Open to any product.
- Admin API Issuance, registration, revocation and policy. Requires a client certificate.
- License status zone DNSSEC-signed TXT records, one per license, named by a hash of its serial.
Trust anchors
The root keys a product pins, and the keys currently signing.