---
title: "Enabling LAPP"
description: "Enabling LAPP in each Lacuna product: PkiConfig.LappEnabled in the PKI SDK, lappEnabled in PKI Express, LacunaPki.LappEnabled in Rest PKI and PkiSuite:LappEnabled in Rest PKI Core, Signer, Amplia, GeCert, PSC and TSA."
canonical: "https://docs.lacunasoftware.com/en-us/articles/lapp/configuration"
locale: "en"
product: "LAPP"
last_updated: "2026-10-22"
---

# Enabling LAPP

LAPP is off by default in every product. Turning it on takes two steps:

1. Set the product's LAPP setting to `true`, as shown below for each product.
2. [Contact support](https://lacuna.help) and ask them to authorize LAPP for your PKI SDK license. Until they do, LAPP refuses your
   requests and the setting has no effect.

Before you start, [check that the server can reach LAPP](https://docs.lacunasoftware.com/en-us/articles/lapp#check).

| Product | Setting |
|---|---|
| [PKI SDK](https://docs.lacunasoftware.com/en-us/articles/lapp/configuration#pki-sdk) | `PkiConfig.LappEnabled = true` |
| [PKI Express](https://docs.lacunasoftware.com/en-us/articles/lapp/configuration#pki-express) | `pkie config --set lappEnabled=true` |
| [Rest PKI (on-premises)](https://docs.lacunasoftware.com/en-us/articles/lapp/configuration#rest-pki) | `LacunaPki.LappEnabled` in `AppSettings.config` |
| [Rest PKI Core, Signer, Amplia, GeCert, PSC and TSA (on-premises)](https://docs.lacunasoftware.com/en-us/articles/lapp/configuration#pkisuite) | `LappEnabled` in the `PkiSuite` section, or the `PkiSuite__LappEnabled` environment variable |

On Lacuna's cloud services (Rest PKI Core, Signer, Amplia and others hosted by Lacuna Software) there is nothing to do: LAPP is
Lacuna's own infrastructure.

## PKI SDK

Set [`PkiConfig.LappEnabled`](https://docs.lacunasoftware.com/en-us/api/Lacuna.Pki/PkiConfig#lappenabled) once, at application startup, after loading the license.
The requests to LAPP carry the license's ID and licensee name, so the license must already be loaded.

```csharp
using Lacuna.Pki;

PkiConfig.LoadLicense(Convert.FromBase64String(sdkLicenseBase64));
PkiConfig.LappEnabled = true;
```

The requests to LAPP use the same settings as the SDK's own downloads:

| `PkiConfig` property | Effect on LAPP |
|---|---|
| `CrlDownloadTimeout` | Time limit of a CRL request to LAPP |
| `CAIssuersDownloadTimeout` | Time limit of a CA certificate request to LAPP |
| `WebProxy` | The proxy the requests to LAPP go through |

The SDK only asks LAPP after the download from the CA's own URL fails, so a validation that falls back to LAPP takes up to two timeouts:
the one of the direct download and the one of the LAPP request. If the firewall drops the packets to the CAs' URLs instead of
rejecting them, each direct download waits for the whole timeout before the SDK tries LAPP.

## PKI Express

```sh
pkie config --set lappEnabled=true
```

See [LAPP integration - PKI Express](https://docs.lacunasoftware.com/en-us/articles/pki-express/config/lapp) and the other [PKI Express settings](https://docs.lacunasoftware.com/en-us/articles/pki-express/config).

## Rest PKI (on-premises)

In the `AppSettings.config` file of your [on-premises Rest PKI](https://docs.lacunasoftware.com/en-us/articles/rest-pki/on-premises) instance, set:

```xml
<add key="LacunaPki.LappEnabled" value="True" />
```

Then restart the site. 

## Rest PKI Core, Signer, Amplia, GeCert, PSC and TSA (on-premises)

These servers read the PKI SDK settings from the `PkiSuite` section, the same section that holds the `SdkLicense` setting. Add
`LappEnabled` to it, in the format of your installation's settings file, and restart the service.

JSON settings file (`appsettings.*.json`):

```json
"PkiSuite": {
    "SdkLicense": "...",
    "LappEnabled": true
}
```

INI settings file (Rest PKI Core's `appsettings.ini` on Windows and `/etc/restpkicore/appsettings.conf` on Linux):

```ini
[PkiSuite]
SdkLicense=...
LappEnabled=true
```

Environment variable (Docker, Azure App Service app settings):

```sh
PkiSuite__LappEnabled=true
```

Where each product keeps the `PkiSuite` section:

| Product | Where |
|---|---|
| Rest PKI Core | [Windows Server](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/on-premises/windows-server): `C:\ProgramData\Lacuna Software\Rest PKI Core\appsettings.ini`. [Linux](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/on-premises/linux/install-ubuntu): `/etc/restpkicore/appsettings.conf`. [Azure](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/on-premises/azure/install): App Service app settings |
| Signer | [Linux](https://docs.lacunasoftware.com/en-us/articles/signer/on-premises/linux/install-ubuntu): `/etc/lacuna-signer/appsettings.linux.json`. [Windows Server](https://docs.lacunasoftware.com/en-us/articles/signer/on-premises/windows): `appsettings.iis.json`. [Docker](https://docs.lacunasoftware.com/en-us/articles/signer/on-premises/docker) and [Azure](https://docs.lacunasoftware.com/en-us/articles/signer/on-premises/azure): environment variables |
| Amplia | The settings file or environment variables of your [installation](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises) |
| GeCert | The settings of your [installation](https://docs.lacunasoftware.com/en-us/articles/gecert/on-premises) |
| PSC, TSA | The settings of your installation ([PSC](https://docs.lacunasoftware.com/en-us/articles/psc/on-premises), [TSA](https://docs.lacunasoftware.com/en-us/articles/tsa/on-premises)) |

## After enabling

LAPP only comes into play when a download from a CA's URL fails, so a working setup shows no difference in normal operation. To see
it working, validate a certificate whose CRL URL the server cannot reach: the validation should succeed instead of ending with the
revocation status unknown. If it still fails, see [Troubleshooting](https://docs.lacunasoftware.com/en-us/articles/lapp/troubleshooting).