License
CertAutoPilot has two tiers, and the only thing that separates them is how many certificates you can hold. Every feature — LDAP/Active Directory, mandatory 2FA (OTP policy), syslog/SIEM forwarding, and everything else — is available in both tiers. Activation is either online (validated against the CloudNativeWorks license API) or offline (a cryptographically signed license file verified locally, no network required). Managed at Settings → License (admin role; org-scoped).
Tiers
| Tier | Certificate limit | Features |
|---|---|---|
| Free (no license key) | 1 | All features |
| Enterprise (valid license) | Set by your license (unlimited if not specified) | All features |
Without a valid license the installation runs on Free with a one-certificate cap. Any valid license makes it Enterprise; the certificate cap is carried in the license itself, so different Enterprise licenses can allow different numbers of certificates (a license with no explicit limit is treated as unlimited).
Activation
The page has an Online / Offline mode switch.
Online
- API key — enter the CloudNativeWorks license API key and save it (stored envelope-encrypted; only the last 4 characters are shown afterwards). The license-key form stays disabled until an API key is configured.
- License key — enter your license key and click Activate. The backend validates the key against
https://license-api.cloudnativeworks.comtogether with a cluster fingerprint, then registers the activation (you get an Activation ID).
Once activated, the backend periodically re-validates — at most one instance per 24-hour window performs the check (deduplicated via the database), and the result is shared cluster-wide. A network failure during re-validation does not invalidate the license: valid and expires_at are left unchanged and only Last Error is updated.
Offline
For air-gapped installations. Paste the contents of your signed offline license file (JSON: {"license": {...}, "signature": "...", "public_key": "..."}) and click Activate Offline License. The signature is verified locally against an Ed25519 public key embedded in the binary at build time — no outbound connection is made. An already-expired file is rejected at upload (offline license expired on <date>).
Deactivate Offline License removes the offline license and reverts to online mode.
Status panel
The right-hand panel shows: validity badge (Valid, or the invalidity reason), mode (online/offline), plan, masked license key, cluster fingerprint, expiry, activation ID, activation time, last check time, and the last validation error if any. The Validate button in the header triggers an immediate re-validation on demand.
Certificate usage
The Certificate Usage card shows count / limit with a progress bar (or "Unlimited certificates" on Enterprise). The count is the total number of certificate records in the installation — across all projects, regardless of status.
Programmatic access:
GET /api/v1/license/status— validity, plan, features, grace state (any authenticated user; used for the UI banner).GET /api/v1/license/usage—{count, limit, remaining, is_unlimited, can_create, can_renew, plan}.
What happens at the limit
Creation and renewal are enforced differently — existing certificates are grandfathered:
| Situation | New certificates | Renew / reissue | Scheduled renewals |
|---|---|---|---|
count < limit | allowed | allowed | run normally |
count = limit (at limit) | blocked — 403 certificate_limit_reached | still allowed | run normally |
count > limit (over limit, e.g. after a plan downgrade) | blocked | blocked — 403 over_certificate_limit | the renewal sweep skips all renewals and logs skipping renewals: over certificate limit |
Renewal jobs that hit the limit fail with over certificate limit (N/M); delete certificates to enable renewals — deleting certificates until count ≤ limit restores renewals, and until count < limit restores creation.
If a plan change leaves you over the new limit, automatic renewals stop fleet-wide until you delete enough certificates. Watch the usage card after any plan change.
Expiry & grace period
When the license expires_at passes, a 7-day grace period begins: the license keeps working (Enterprise certificate cap intact) and the UI banner shows the remaining grace time. After the grace period the license is treated as invalid and the installation reverts to Free — the one-certificate cap applies to new issuance. All features stay available throughout; only the certificate cap changes.
See also
- Auth & RBAC — only admins manage the license; owner-level actions
- Renewal — how scheduled renewals work
- Administration overview