Encrypt CMS Logo
EncryptCMS v1.3.6 Stable
Demo
Home / Docs / licensing
Security & Licensing

Central Licensing System

Ed25519 asymmetric cryptography, license activation, 14-day offline grace, and decoupling.

Central Licensing System (CLS)

Encrypt CMS is architected with a decoupled, resilient licensing model. Understanding how licensing works ensures that your website remains stable, performant, and fully operational under all conditions.

1. Core Principles: Freedom & Decoupling

  • Core CMS is 100% License-Free: The core CMS application, admin dashboard, content publishing, user management, and core security updates (CoreUpdateService) operate independently and never require a license key.
  • Commercial Addons & Ecosystem Extensions: Commercial extensions and premium plugins connect to the Central License Server (CLS) to verify entitlements, receive single-use signed download tokens, and download authenticated updates.

2. Cryptographic Security with Ed25519

The Central License Server uses Ed25519 asymmetric cryptography rather than insecure shared secrets:

  1. Signed Tokens: License verification tokens are digitally signed with the CLS private key.
  2. Local Public Key Trust Store: The CMS core ships with trusted public keys in config/licensing.php.
  3. Local Verification: The CMS verifies signature authenticity locally without exposing private credentials or passing plain passwords.

3. Offline Resilience & Grace Periods

A common failure mode in traditional CMS platforms is website disruption when an external licensing server experiences downtime. Encrypt CMS eliminates this vulnerability:

Mechanism Duration Behavior
Signed Cache TTL 48 Hours License status is securely cached locally for 48 hours. No external network request is made during this window.
Outage Grace Period 14 Days If the licensing server is unreachable when the cache expires, the CMS enters an active 14-day grace period. Commercial features continue running uninterrupted.
Grace Logging Non-blocking Diagnostic notices are logged to storage/logs/audit.log without displaying intrusive banners to website visitors.

4. License Activation (/admin/license)

To activate a commercial license:

  1. Navigate to Admin > License in your dashboard.
  2. Enter your authoritative license key (format: ENC-XXXX-XXXX-XXXX-XXXX).
  3. Click Activate License.
  4. The CMS establishes an encrypted HTTPS handshake with the Central License Infrastructure, validates the domain binding, and registers the installation token.