LAPP - Artifact Provider Proxy for PKI

LAPP (Lacuna Artifact Provider Proxy) is a service run by Lacuna Software that downloads PKI artifacts, certificate revocation lists (CRLs) and CA certificates, on behalf of your server. When your server cannot reach the URL a certificate points to, because a firewall blocks it, the network has no route to it or the CA's server is unstable, the PKI SDK asks LAPP for the same file instead.

LAPP is not a product you integrate with: you turn on one setting in the Lacuna product you already use, and Lacuna support authorizes your license. See Enabling LAPP.

When to use LAPP

To validate a certificate or a signature, the PKI SDK needs the CRLs of every CA in the certificate chain and, when a CA certificate is missing, the CA certificate itself. It downloads them from the URLs written in the certificates (the CRL Distribution Points and Authority Information Access extensions). Those URLs belong to many different CAs, so they are hard to allow one by one on a firewall, and some of them go down from time to time.

Enable LAPP when:

• the server's firewall only allows outbound access to a short list of hosts, so allowing every CA's URL is not practical;
• the CAs' URLs are unstable, and validations fail now and then with the revocation status unknown;
• you want a second source for CRLs and CA certificates, in case the CA's own server is down.

With LAPP, the firewall only needs to allow one host, lapp-fx-brs.lacunasoftware.com (see below).

How it works

LAPP is a fallback: the PKI SDK always tries the CA's own URL first, and only asks LAPP when that fails.

1. The PKI SDK needs a CRL or a CA certificate and downloads it from the URL in the certificate.
2. If the download fails, times out or, for a CRL, returns one that is not newer than the copy the SDK already has, and LAPP is enabled, the SDK sends the same URL to LAPP, together with the ID and the licensee name of your PKI SDK license.
3. LAPP checks that your license is authorized (see below).
4. For a CRL, LAPP returns the copy it keeps, if it is recent enough. Otherwise it downloads the CRL from the original URL, from its own servers in parallel, and returns the first good answer. (When the SDK only asks for "the latest CRL" of a URL, LAPP answers from the copies it keeps.) For a CA certificate, it downloads the file from the original URL in the same way.
5. The PKI SDK caches what it received and goes on with the validation as if it had downloaded the file itself.

LAPP also answers the PKI SDK's other fallback lookups: a CA certificate by its key identifier, by its subject name, or by issuer and serial number, from the certificates it has collected.

CRLs stay fresh on LAPP

Once a client asks LAPP for a CRL, LAPP keeps track of that distribution point. Every 3 minutes it checks the CRLs it keeps and downloads the next one when 80% of the current CRL's validity has passed, so the copy it serves is usually newer than the one your server would get on its own. CRLs of expired CAs are no longer refreshed.

What LAPP does not do

• LAPP only serves CRLs and CA certificates. Other outbound calls of your application, such as time-stamp requests or calls to Lacuna's cloud services, do not go through it.
• LAPP does not change how a certificate is validated: the PKI SDK checks the CRL and the CA certificate it gets from LAPP exactly as it would check the ones it downloads itself.
• LAPP does not replace a proxy: if your server reaches the internet through one (PkiConfig.WebProxy in the PKI SDK, the proxy settings in PKI Express), keep it configured; the requests to LAPP also go through it.

Requirements

Network access

The server running the PKI SDK needs outbound access to:

Host	Protocol and port	Used for
lapp-fx-brs.lacunasoftware.com	HTTP, TCP 80	Every LAPP request (POST /api/crls/... and POST /api/certificates/...)

The PKI SDK calls LAPP over plain HTTP, like most CRL and CA certificate URLs. Requests carry the URL being fetched and your license's ID and licensee name; responses are CRLs and CA certificates, which are public and signed by their CAs.

An authorized license

LAPP only answers requests from PKI SDK licenses that Lacuna Software has authorized. Enabling the setting is not enough: also contact support and ask them to authorize LAPP for your license. Have your license's licensee name at hand.

Requests from a license that is not authorized get 422 Unprocessable Entity, and the PKI SDK carries on without the file. See Troubleshooting.

Check that the server can reach LAPP

From the server, call the LAPP status route. It needs no license:

curl http://lapp-fx-brs.lacunasoftware.com/api/system/info

The answer is the service name, version and current time:

{"name":"Lacuna.Lapp.Function","version":"0.5.0.0","timestamp":"2026-10-22T20:03:17.0336594+00:00"}

If the call fails, the firewall or the proxy is blocking the host. On Windows, use curl.exe in PowerShell, or open the URL in a browser on the server.

Next steps

• Enabling LAPP in the PKI SDK, PKI Express, Rest PKI, Rest PKI Core, Signer and the other on-premises servers.
• Troubleshooting validations that still fail with LAPP enabled.