The licensing chain
Root-signed licences, signing authorities with limits, how products verify a licence, online check-in and revocation.
Licence formats#
| Format | Signed by | Carries |
|---|---|---|
OTG1 |
Root key | Product, Installation ID (or any), customer, modules, start, expiry; seats and tier for a GUARD |
OTGA1 |
Root key | An authority's own public key and its limits: products, modules, counts, latest expiry, validity |
OTG2 |
An authority's key | The same as OTG1, plus the authority's certificate and ID |
Every part is compact JSON with sorted keys; signatures are Ed25519 over the exact bytes. A key can be pasted anywhere and verified offline.
Signing authorities#
Customers with a VIEW fleet, or a stand-alone GUARD, receive a signing authority: their own VIEW or GUARD generates a key pair and the Licensing Authority certifies the public key with limits. The authority then licenses the systems in its fleet by itself, even when disconnected, and reports every key it issues back to the Licensing Authority — online, signed with its own key, or as a signed ledger file.
What a product verifies#
For an authority-issued (OTG2) licence a product checks, offline:
- the authority certificate is signed by a root key the product trusts;
- the licence is signed by the certified authority key, and names that authority;
- the authority may license this product and these modules;
- the licence starts within the certificate's validity and doesn't run past the authority's latest expiry.
A key that fails any check is rejected with the reason in plain words.
Online check-in and revocation#
ATS and NTS with internet access check in with the Licensing Authority about two minutes after start and every six hours. They send only: the product, the Installation ID, the host name, the software version and the IDs of the licences they hold (not the keys). The answer gives each licence's status and any renewed keys for that installation.
A revoked licence is marked revoked on the box at its next check-in and stays revoked across restarts. Check-in can be switched off on a box that must never contact the internet; that box then relies on its keys' expiry dates.
Licensing never stops protection. A module without a valid licence has a 30-day grace period and then becomes restricted: protection keeps running as configured; only configuration changes for that module are blocked.