Skip to main content
Self-hosted CertForge requires a license file (license.jwt) to operate. The license is a signed JWT — it encodes your entitlements and cannot be modified.

​
Obtaining a license

Trial (30 days)

Request from the download page. Delivered by email immediately.

Commercial

Contact sales@certforge.xyz. Delivered when payment is confirmed.

​
What the license controls

If a limit is exceeded, new issuances are blocked but existing certificates continue to work.

​
How verification works

On startup — offline: The JWT signature is verified against the CertForge public key embedded in the binary. The expiry date is read from the signed exp claim. This happens entirely offline, before any network call, and cannot be bypassed by blocking outbound traffic. Call-home (periodic): Every 24 hours, CertForge pings app.certforge.xyz to report usage and receive updated license state. Renewals and upgrades take effect without restarting.

​
Grace period

If the license expires and call-home cannot reach app.certforge.xyz:

​
Installing the license

Place license.jwt in your storage.base_path directory (default: /opt/certforge/data/):

​
Call-home behind a proxy

For fully air-gapped environments (no outbound internet possible even through a proxy), contact sales@certforge.xyz for an offline license arrangement.

​
License dashboard

View license status at /license in the dashboard:
  • Current plan, expiry, limits, and features
  • Call-home history (timestamp and status of recent pings)
  • Download the current license.jwt file

​
Renewal

When your license is renewed, a new license.jwt is emailed. Install it the same way as the initial installation, then restart. Call-home will also detect the renewal automatically if your license is renewed before the current one expires.