--- title: "LAPP - Artifact Provider Proxy for PKI" description: "LAPP, Lacuna's Artifact Provider Proxy for PKI: a fallback service that fetches CRLs and CA certificates for the PKI SDK when the server cannot reach the CAs' own URLs. How it works, what it needs and how to check it." canonical: "https://docs.lacunasoftware.com/en-us/articles/lapp" locale: "en" product: "LAPP" last_updated: "2026-10-22" --- # LAPP - Artifact Provider Proxy for PKI LAPP (*Lacuna Artifact Provider Proxy*) is a service run by Lacuna Software that downloads PKI artifacts, **certificate revocation lists (CRLs)** and **CA certificates**, on behalf of your server. When your server cannot reach the URL a certificate points to, because a firewall blocks it, the network has no route to it or the CA's server is unstable, the [PKI SDK](https://docs.lacunasoftware.com/en-us/articles/pki-sdk) asks LAPP for the same file instead. LAPP is not a product you integrate with: you turn on one setting in the Lacuna product you already use, and Lacuna support authorizes your license. See [Enabling LAPP](https://docs.lacunasoftware.com/en-us/articles/lapp/configuration). ## When to use LAPP To validate a certificate or a signature, the PKI SDK needs the CRLs of every CA in the certificate chain and, when a CA certificate is missing, the CA certificate itself. It downloads them from the URLs written in the certificates (the *CRL Distribution Points* and *Authority Information Access* extensions). Those URLs belong to many different CAs, so they are hard to allow one by one on a firewall, and some of them go down from time to time. Enable LAPP when: - the server's firewall only allows outbound access to a short list of hosts, so allowing every CA's URL is not practical; - the CAs' URLs are unstable, and validations fail now and then with the revocation status unknown; - you want a second source for CRLs and CA certificates, in case the CA's own server is down. With LAPP, the firewall only needs to allow one host, `lapp-fx-brs.lacunasoftware.com` ([see below](https://docs.lacunasoftware.com/en-us/articles/lapp#network)). ## How it works LAPP is a **fallback**: the PKI SDK always tries the CA's own URL first, and only asks LAPP when that fails. 1. The PKI SDK needs a CRL or a CA certificate and downloads it from the URL in the certificate. 2. If the download fails, times out or, for a CRL, returns one that is not newer than the copy the SDK already has, and LAPP is enabled, the SDK sends the same URL to LAPP, together with the ID and the licensee name of your PKI SDK license. 3. LAPP checks that your license is authorized ([see below](https://docs.lacunasoftware.com/en-us/articles/lapp#authorization)). 4. For a CRL, LAPP returns the copy it keeps, if it is recent enough. Otherwise it downloads the CRL from the original URL, from its own servers in parallel, and returns the first good answer. (When the SDK only asks for "the latest CRL" of a URL, LAPP answers from the copies it keeps.) For a CA certificate, it downloads the file from the original URL in the same way. 5. The PKI SDK caches what it received and goes on with the validation as if it had downloaded the file itself. LAPP also answers the PKI SDK's other fallback lookups: a CA certificate by its key identifier, by its subject name, or by issuer and serial number, from the certificates it has collected. ### CRLs stay fresh on LAPP Once a client asks LAPP for a CRL, LAPP keeps track of that distribution point. Every 3 minutes it checks the CRLs it keeps and downloads the next one when 80% of the current CRL's validity has passed, so the copy it serves is usually newer than the one your server would get on its own. CRLs of expired CAs are no longer refreshed. ### What LAPP does not do - LAPP only serves CRLs and CA certificates. Other outbound calls of your application, such as time-stamp requests or calls to Lacuna's cloud services, do not go through it. - LAPP does not change how a certificate is validated: the PKI SDK checks the CRL and the CA certificate it gets from LAPP exactly as it would check the ones it downloads itself. - LAPP does not replace a proxy: if your server reaches the internet through one (`PkiConfig.WebProxy` in the PKI SDK, the [proxy settings](https://docs.lacunasoftware.com/en-us/articles/pki-express/config/proxy) in PKI Express), keep it configured; the requests to LAPP also go through it. ## Requirements ### Network access The server running the PKI SDK needs outbound access to: | Host | Protocol and port | Used for | |---|---|---| | `lapp-fx-brs.lacunasoftware.com` | HTTP, TCP 80 | Every LAPP request (`POST /api/crls/...` and `POST /api/certificates/...`) | The PKI SDK calls LAPP over plain HTTP, like most CRL and CA certificate URLs. Requests carry the URL being fetched and your license's ID and licensee name; responses are CRLs and CA certificates, which are public and signed by their CAs. ### An authorized license LAPP only answers requests from PKI SDK licenses that Lacuna Software has authorized. Enabling the setting is not enough: also [contact support](https://lacuna.help) and ask them to authorize LAPP for your license. Have your license's licensee name at hand. Requests from a license that is not authorized get `422 Unprocessable Entity`, and the PKI SDK carries on without the file. See [Troubleshooting](https://docs.lacunasoftware.com/en-us/articles/lapp/troubleshooting#not-authorized). ## Check that the server can reach LAPP From the server, call the LAPP status route. It needs no license: ```sh curl http://lapp-fx-brs.lacunasoftware.com/api/system/info ``` The answer is the service name, version and current time: ```json {"name":"Lacuna.Lapp.Function","version":"0.5.0.0","timestamp":"2026-10-22T20:03:17.0336594+00:00"} ``` If the call fails, the firewall or the proxy is blocking the host. On Windows, use `curl.exe` in PowerShell, or open the URL in a browser on the server. ## Next steps - [Enabling LAPP](https://docs.lacunasoftware.com/en-us/articles/lapp/configuration) in the PKI SDK, PKI Express, Rest PKI, Rest PKI Core, Signer and the other on-premises servers. - [Troubleshooting](https://docs.lacunasoftware.com/en-us/articles/lapp/troubleshooting) validations that still fail with LAPP enabled.