---
title: "Digiploma settings"
description: "Requirements and settings of an on-premises Digiploma instance: JSON file per platform, environment variable overrides and settings grouped by purpose."
canonical: "https://docs.lacunasoftware.com/en-us/articles/digiploma/on-premises/settings"
locale: "en"
product: "Digiploma"
last_updated: "2026-10-11"
---

# Digiploma settings

An on-premises instance reads its settings from a JSON file:

| Platform | File |
|---|---|
| Windows (IIS) | `appsettings.iis.json`, in the application folder |
| Linux | `/etc/lacuna-digiploma/appsettings.linux.json` |

Environment variables override the file, with `__` between section and key (for example `General__SiteUrl`).

The sections below are grouped by purpose. Keys spelled oddly, such as `EnableIdentiferMaskingOnDegreeValidation`, must be typed exactly as
shown.

## Requirements

* .NET 8 (ASP.NET Core Runtime), since version 3.0.0
* SQL Server
* A Lacuna Signer instance (see [Signer integration setup](https://docs.lacunasoftware.com/en-us/articles/digiploma/on-premises/signer-setup))
* A license of the Lacuna PKI SDK that covers the version used by Digiploma (see the [changelog](https://docs.lacunasoftware.com/en-us/articles/digiploma/changelog))

## Database and storage

* **ConnectionStrings:DefaultConnection**: connection string of the SQL Server database, such as
  `Data Source=SERVER;Initial Catalog=DATABASE;User ID=USERNAME;Password=PASSWORD`.
* **General:AutoUpdateDatabase** (default: `true`): after an update, the application applies the changes to the database model when
  needed. Set to `false` if the application does not have owner permissions over the database.
* **BlobStorage:Type**: where files are stored, such as `FileSystem`.
* **BlobStorage:Path**: for `FileSystem`, the folder where files are stored; the application needs write access to it. On Linux the
  default is `/var/lacuna-digiploma`; on Windows there is no default, so set it.

## General settings

Under section **General**:

* **SiteUrl**: publicly accessible URL of the website (e.g.: `https://digiploma.patorum.com/`). It is used in the links of outgoing emails,
  in the validation address and QR code printed on the documents (unless a template sets its own), and in the links of inspection files.
* **SiteName**: name of the instance, shown in the page titles and in the API reference.
* **EncryptionKey**: 256-bit key, in Base64, used to encrypt the secrets stored by the application. Generate one, for example with
  `openssl rand -base64 32`, and keep it: secrets encrypted with it cannot be read with another key.
* **SupportEmailAddress**: the support email address (used on the footer of outgoing emails).
* **Theme**: color scheme of the web application: `mse`, `cgo`, `obg`, `epg` or `yby`, or empty for the default.
* **UserManualUrl**: when set, the web application shows a button to download the user manual from this address.

### Signer integration

* **SignerUrl**: the URL of the Signer that will be used to create documents.
* **UploadsPerRequest** (default: `50`): number of files per document create request to Signer. Batches are processed in groups of this
  size.
* **DisableCertificateLevelRequirementToSign** (v1.6.0): if `true`, disables the requirement that all certificates used to sign documents
  are A3. Partial academic transcripts never require A3 certificates.

### Validation and publication

* **DisableRecaptcha** (v1.6.0): if `true`, disables the reCAPTCHA of the validation page, even when its keys are set.
* **EnableIdentiferMaskingOnDegreeValidation** (default: `true`): masks the student's CPF in the public validation.
* **IsNonProductionEnvironment** (default: `false`): if `true`, the generated XML files declare the *Homologação* environment instead of
  *Produção*. Use it on test instances.
* **GenerateCancellationListInDays** (default: `120`): a new list of annulled diplomas is generated when the deadline of the current one,
  180 days after it was generated, is less than this number of days away. It must be less than 180.
* **DegreeFileTicketValidityPeriodInDays** (default: `14`): how many days the document links in inspection files remain valid.

### Registration

* **EnableRegistrationRequestAcceptStep** (default: `false`): registration requests that come from an issuer start waiting to be accepted
  (**Aguardando aceitação**) before the review.
* **RequireManualRegistrationAcceptance** (default: `false`): together with the previous key, requests uploaded by the registrar itself also
  need to be accepted.
* **AllowSkipSignatureValidation** (default: `false`): allows the registrar to skip the validation of the signatures of the academic
  documentation files it uploads (**Pular validação das assinaturas**).

### Uploads

* **MaxUploadSizeInBytes** (default: `631242752`, about 600 MB): the maximum size of a request. On IIS, the `web.config` file also limits
  it, to 1.5 GB.
* **UploadedFilesValidityInDays** (default: `1`): how long the web application considers a file uploaded for a form still available.

### Document generation

* **UseSocialNameInAcademicTrancript** (default: `true`): shows the student's social name in the visual representation of academic
  transcripts.

### Validation of files and signatures

These keys turn off checks. Leave them at their defaults in production.

* **DisableDegreeXmlStructureValidationOnCreation**, **DisableAcademicDocXmlStructureValidationOnCreation**,
  **DisableAcademicTranscriptXmlStructureValidationOnCreation**, **DisableCurriculumXmlStructureValidationOnCreation** (default: `false`):
  skip the validation, against the MEC XML schema, of the files generated by Digiploma.
* **DisableAcademicDocScructureValidationInRegistration**, **DisableUploadedDegreeXmlStructureValidationInEmission** (default: `false`):
  skip the validation, against the MEC XML schema, of the academic documentation files received by a registrar and of the diploma files
  received by an issuer.
* **DisableDegreeXmlExtensiveValidation** (default: `false`): skips the ICP-Brasil checks of the signatures of received XML files and of
  institution certificates.
* **AllowRevocationStatusUnknown** (default: `false`): accepts signatures whose certificate revocation status cannot be checked, with a
  warning.
* **AllowPersonalCertificateInInstitute** (default: `false`): accepts an e-CPF certificate as an institution's certificate. For tests only.

## Batches settings (v1.6.0)

Under section **Batches**:

* **MaxDegreesInBatch** (default: `50000`): the maximum number of documents in a bulk operation, such as a bulk download or an inspection
  file.
* **MaxItemsRetrievedFromDatabase** (default: `10000`): the number of documents read from the database in each round of a bulk operation,
  and the maximum number of documents selected at once.

## Recaptcha settings (v1.6.0)

Under section **Recaptcha**, the keys of a Google reCAPTCHA v2 *invisible* site. The validation page uses reCAPTCHA when both are set
(and **General:DisableRecaptcha** is not `true`).

* **SiteKey**: the Captcha site key.
* **SecretKey**: the Captcha secret key.

## Restamp and timestamp settings

Digiploma renews the archive timestamps of the signed documents before they expire (see [Restamps](https://docs.lacunasoftware.com/en-us/articles/digiploma/api/restamps)). This requires a
timestamp server, under section **Timestamper**:

* **Url**: the URL of the timestamp server.
* **Type** (default: `BearerToken`): how to authenticate to it: `BearerToken`, `BasicAuthentication` or `BasicAuthenticationV2`.
* **BearerToken**, or **Username** and **Password**: the credentials.
* **Enabled** (default: `false`): also timestamps the signatures that Digiploma makes itself, on the lists of annulled diplomas and the
  inspection files.
* **MaxAutoRetryCount** (default: `3`) and **RetryDelayInMilliseconds** (default: `1500`): retries of a failed request.

Under section **Restamp**:

* **DisableRestamp** (default: `false`): turns restamping off for the whole instance. Set it to `true` if the instance has no timestamp
  server.
* **RestampDocumentsBeforeExpiringInDays** (default: `180`): how many days before the expiration a document is restamped.
* **EnableRegistrationRestamp** (default: `false`): also restamps the diploma files of registration requests.
* **DisableWebhookSending** (default: `true`): set it to `false` to send the restamp webhooks.
* **DocumentsToRestampOnBusinessHours** / **DocumentsToRestampNotOnBusinessHours** (default: `10` / `50`) and
  **RestampsToCreateOnBusinessHours** / **RestampsToCreateNotOnBusinessHours** (default: `10` / `50`): how many documents each run of the
  restamp jobs processes.

Under section **BusinessHours**, the business hours, when the background jobs process fewer items:

* **StartHour** (default: `8`) and **EndHour** (default: `18`).
* **IsWeekendBusinessDays** (default: `false`).
* **TimeZoneId** (default: `E. South America Standard Time`): also the time zone of the nightly restamp jobs.

## Visual representation settings

Under section **VisualRepresentation**, the default margins, in centimeters, offered when creating academic transcript and curriculum
templates: **MarginTopInCentimeters** (`3.5`), **MarginBottomInCentimeters** (`1`), **MarginLeftInCentimeters** (`1`) and
**MarginRightInCentimeters** (`1`).

## Validation page customization

Under section **Customization**, the validation page can show an organization's own name, logo and colors, on its own domain. Under
**Subscriptions**, add an entry named after the organization's id (or `{organization id}_{MEC code}`, for one of its institutions):

```json
"Customization": {
  "Subscriptions": {
    "4c1e…": {
      "Name": "Universidade Exemplo",
      "Domains": "diplomas.exemplo.edu.br",
      "LogoUrl": "https://exemplo.edu.br/logo.png",
      "FaviconUrl": "https://exemplo.edu.br/favicon.ico",
      "Theme": "obg"
    }
  }
}
```

A request to a domain other than the one in **General:SiteUrl** is redirected to the validation page.

## Reverse proxy

Under section **Bindings**:

* **UseReverseProxy**: `true` when the application runs behind a reverse proxy, as in the Linux setup. The `X-Forwarded-For` and
  `X-Forwarded-Proto` headers are then honored.
* **AcceptForwardedHostHeader** (default: `false`): also honors the `X-Forwarded-Host` header.
* **ReverseProxyForwardLimit**: the maximum number of proxies in the `X-Forwarded-*` headers.
* **HttpsMode**: set to `Optional` if HTTPS is disabled.

## Licenses

Under section **PkiSuite**:

* **SdkLicense**: the license of the Lacuna PKI SDK, in Base64. Required.