---
title: "LAPP Integration - PKI Express"
description: "Enabling LAPP, the Artifact Provider Proxy for PKI, in PKI Express to fetch CRLs and CA certificates when network access is restricted."
canonical: "https://docs.lacunasoftware.com/en-us/articles/pki-express/config/lapp"
locale: "en"
product: "PKI Express"
last_updated: "2026-10-22"
---

# LAPP Integration - PKI Express

This article describes how to configure the use of [LAPP](https://docs.lacunasoftware.com/en-us/articles/lapp) - Artifact Provider Proxy for PKI.

LAPP is a service run by Lacuna Software that fetches PKI resources, such as CRLs and CA certificates, on behalf of PKI Express. When
PKI Express cannot download a CRL or a CA certificate from the URL in the certificate, it asks LAPP for the same file, so the server
only needs outbound access to one host: `lapp-fx-brs.lacunasoftware.com` (HTTP, port 80). See [how LAPP works](https://docs.lacunasoftware.com/en-us/articles/lapp#how-it-works).

We recommend the LAPP when:
- the server's firewall blocks access to external URLs;
- the URLs containing the CRLs and CA certificates suffer from instabilities.

By default, the integration is disabled. To enable it, you need the following command:

```sh
pkie config --set lappEnabled=true
```

> **Note**
>
> Besides the activation, you need to contact our support team at [lacuna.help](https://lacuna.help) to authorize your license to use
> LAPP.

If validations still end with `CertificateRevocationStatusUnknown` after enabling LAPP, see [Troubleshooting LAPP](https://docs.lacunasoftware.com/en-us/articles/lapp/troubleshooting).