Enabling LAPP

LAPP is off by default in every product. Turning it on takes two steps:

1. Set the product's LAPP setting to true, as shown below for each product.
2. Contact support and ask them to authorize LAPP for your PKI SDK license. Until they do, LAPP refuses your requests and the setting has no effect.

Before you start, check that the server can reach LAPP.

Product	Setting
PKI SDK	PkiConfig.LappEnabled = true
PKI Express	pkie config --set lappEnabled=true
Rest PKI (on-premises)	LacunaPki.LappEnabled in AppSettings.config
Rest PKI Core, Signer, Amplia, GeCert, PSC and TSA (on-premises)	LappEnabled in the PkiSuite section, or the PkiSuite__LappEnabled environment variable

On Lacuna's cloud services (Rest PKI Core, Signer, Amplia and others hosted by Lacuna Software) there is nothing to do: LAPP is Lacuna's own infrastructure.

PKI SDK

Set PkiConfig.LappEnabled once, at application startup, after loading the license. The requests to LAPP carry the license's ID and licensee name, so the license must already be loaded.

using Lacuna.Pki;

PkiConfig.LoadLicense(Convert.FromBase64String(sdkLicenseBase64));
PkiConfig.LappEnabled = true;

The requests to LAPP use the same settings as the SDK's own downloads:

PkiConfig property	Effect on LAPP
CrlDownloadTimeout	Time limit of a CRL request to LAPP
CAIssuersDownloadTimeout	Time limit of a CA certificate request to LAPP
WebProxy	The proxy the requests to LAPP go through

The SDK only asks LAPP after the download from the CA's own URL fails, so a validation that falls back to LAPP takes up to two timeouts: the one of the direct download and the one of the LAPP request. If the firewall drops the packets to the CAs' URLs instead of rejecting them, each direct download waits for the whole timeout before the SDK tries LAPP.

PKI Express

pkie config --set lappEnabled=true

See LAPP integration - PKI Express and the other PKI Express settings.

Rest PKI (on-premises)

In the AppSettings.config file of your on-premises Rest PKI instance, set:

<add key="LacunaPki.LappEnabled" value="True" />

Then restart the site.

Rest PKI Core, Signer, Amplia, GeCert, PSC and TSA (on-premises)

These servers read the PKI SDK settings from the PkiSuite section, the same section that holds the SdkLicense setting. Add LappEnabled to it, in the format of your installation's settings file, and restart the service.

JSON settings file (appsettings.*.json):

"PkiSuite": {
    "SdkLicense": "...",
    "LappEnabled": true
}

INI settings file (Rest PKI Core's appsettings.ini on Windows and /etc/restpkicore/appsettings.conf on Linux):

[PkiSuite]
SdkLicense=...
LappEnabled=true

Environment variable (Docker, Azure App Service app settings):

PkiSuite__LappEnabled=true

Where each product keeps the PkiSuite section:

Product	Where
Rest PKI Core	Windows Server: C:\ProgramData\Lacuna Software\Rest PKI Core\appsettings.ini. Linux: /etc/restpkicore/appsettings.conf. Azure: App Service app settings
Signer	Linux: /etc/lacuna-signer/appsettings.linux.json. Windows Server: appsettings.iis.json. Docker and Azure: environment variables
Amplia	The settings file or environment variables of your installation
GeCert	The settings of your installation
PSC, TSA	The settings of your installation (PSC, TSA)

After enabling

LAPP only comes into play when a download from a CA's URL fails, so a working setup shows no difference in normal operation. To see it working, validate a certificate whose CRL URL the server cannot reach: the validation should succeed instead of ending with the revocation status unknown. If it still fails, see Troubleshooting.