---
title: "GeCert on-premises"
description: "GeCert on-premises: an instance hosted by Lacuna or on your own infrastructure (Windows Server, Linux or Docker), the prerequisites (SQL Server, GrantID, PKI SDK license) and the configuration sections."
canonical: "https://docs.lacunasoftware.com/en-us/articles/gecert/on-premises"
locale: "en"
product: "GeCert"
last_updated: "2026-10-13"
---

# GeCert on-premises

[GeCert](https://docs.lacunasoftware.com/en-us/articles/gecert) can be used on an instance hosted by Lacuna or you can host your own instance.

## Supported platforms

GeCert is an ASP.NET Core (.NET 6) application, distributed as an installation package or as a Docker image, compatible with:

* Windows Server
* Linux
* Docker

> **Note**
>
> The setup instructions are currently under construction. If you need instructions that are not yet available, please contact us.

## Prerequisites

* A **SQL Server** database, given in the `ConnectionStrings:DefaultConnection` connection string. The database model is created and
  updated by the application itself. 
* A **[GrantID](https://docs.lacunasoftware.com/en-us/articles/grant-id)** subscription, in the cloud or on-premises, for user authentication. See
  [Configure OpenID Connect](https://docs.lacunasoftware.com/en-us/articles/gecert/on-premises/configure-oidc).
* A **[PKI SDK](https://docs.lacunasoftware.com/en-us/articles/pki-sdk)** license, in Base64, in the `PkiSuite:SdkLicense` setting.
* A key store besides the database, if you are going to keep the keys in an HSM, in Azure Key Vault or in a PKCS #11 device. See
  [Configure key stores](https://docs.lacunasoftware.com/en-us/articles/gecert/on-premises/configure-key-stores).
* For the users, [Gecert Connect](https://docs.lacunasoftware.com/en-us/articles/gecert/gecert-connect) installed on Windows, pointing to the instance. See
  [Configure Gecert Connect on the server](https://docs.lacunasoftware.com/en-us/articles/gecert/on-premises/configure-gecert-connect).

## Configuration

The configuration lives in the application's `appsettings.json` file, in an `.ini` or `.conf` file or in environment variables, as in the
other Lacuna products: the `Oidc` section corresponds to the `Oidc__Authority` variable, and so on. 

| Section | What it configures |
|---|---|
| `ConnectionStrings:DefaultConnection` | The SQL Server connection string |
| `General` | `SiteUrl`, the public address of the instance; `SiteName`, the name shown on the sign-in screen (default: `Gecert`); `EncryptionKey`, the key that protects the sensitive data the application stores |
| `Oidc` | The GrantID integration. See [Configure OpenID Connect](https://docs.lacunasoftware.com/en-us/articles/gecert/on-premises/configure-oidc) |
| `KeyStores` | The key stores. See [Configure key stores](https://docs.lacunasoftware.com/en-us/articles/gecert/on-premises/configure-key-stores) |
| `GecertConnect` | What Gecert Connect reads from the server. See [Configure Gecert Connect on the server](https://docs.lacunasoftware.com/en-us/articles/gecert/on-premises/configure-gecert-connect) |
| `PkiSuite:SdkLicense` | The PKI SDK license, in Base64 |
| `BlobStorage` | Where the application keeps the uploaded files (the PKCS #12 files and certificates, deleted after import) and the keys' CSRs: `Type` `FileSystem` with `Path`, or a cloud storage with `ConnectionString` and `ContainerName`, as in [Amplia](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises/configure-blob-storage) |
| `Email` | The SMTP server used for user invitations: `ServerHost`, `SenderAddress`, `SenderName`, `Username` and `Password`, as in [Amplia](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises/configure-email) |
| `Serilog` | The application logs |

## See also

* [Configure key stores](https://docs.lacunasoftware.com/en-us/articles/gecert/on-premises/configure-key-stores)
* [Configure Gecert Connect on the server](https://docs.lacunasoftware.com/en-us/articles/gecert/on-premises/configure-gecert-connect)
* [Configure OpenID Connect](https://docs.lacunasoftware.com/en-us/articles/gecert/on-premises/configure-oidc)
* [Checking the version of GeCert](https://docs.lacunasoftware.com/en-us/articles/gecert/on-premises/check-version)
* [Changelog](https://docs.lacunasoftware.com/en-us/articles/gecert/changelog)