License

What this screen is for

The License screen shows the deployment licence of the installation, one per deployment and never per tenant. It is where you download the activation request a licence is issued from, and where the signed licence file is imported.

Its banner states the posture, TRIAL, LICENSED, IN GRACE or EXPIRED, with the days remaining; below it the installation, the imported licence's details, capability modules, compliance packs and commercial terms are listed. The decisions here are requesting a licence and importing it. What the licence decides on this installation is narrower than the screen suggests, and the sections below say exactly what.

What must exist first

The screen is offered in system context only; opening it while a tenant is assumed returns you to that tenant's dashboard. Most of its labels are shown in English whatever language the console is set to; the Installation card and the licence ID, issue and signing-key labels follow the console language.

The permission to read the platform licence shows the screen and Download activation request; without it the screen says so and names the permission. The permission to import a licence shows Import license. The permission to list tenants fills the capacity bar; without it the bar shows usage unavailable.
The licence service must answer; when it does not, the screen says The license service did not respond and offers Retry. The permission to read the platform algorithm catalogue resolves the compliance pack chips into their titles and links. The roles that read the licence hold it.

Decisions you make here

Reading the posture

The installation starts on a 30-day trial written when it is created, and the banner reads Trial · N day(s) left · no license imported. Once a licence is imported, the banner names its edition and the days to renewal. A licence stays in force through its grace period: after its end date the posture becomes IN GRACE and counts the days left in that window, and only when the grace period has also elapsed does it become EXPIRED. An expired trial reads EXPIRED with no licence to show.

The licence in force is the imported licence whose start date is the latest among those whose window covers today. A renewal imported early is inert until its own start date; a shorter licence starting today outranks a longer one that started earlier.

Reading an AWS Marketplace entitlement

When Source reads AWS Marketplace, the deployment is entitled automatically by the identity document AWS signs for the instance, verified on the instance. The screen shows the entitlement status, Enterprise — no usage quotas, and the installation's identification: AWS account, instance, Region, instance type, product code and the last verification. It shows no expiry date, countdown, grace period, import, renewal or activation request. Billing, the free trial and charges are managed in AWS, and this console shows no charge and no trial date.

The instance must run from the subscribed ANKASecure AMI, with the instance metadata service set to IMDSv2 required and a hop limit of 1. When the status reads Verified · retrying, the last reading could not be renewed: the entitlement stays in force until the date shown, and a later success needs no action. When it reads Not verified, cryptographic operations that create new protection or new key material are refused; licence status and health stay readable.

In both cases the screen names the cause and the command to run on the instance, sudo systemctl start ankasecure-license-evidence@<environmentName>.service; the licence server picks up the new reading within about a minute. When the cause says the instance was not launched from the AWS Marketplace listing, run the deployment on an instance launched from the subscribed AMI.

Reading the installation

The Installation card shows the Installation ID and the Environment name in every posture. The installation ID is generated when the environment is created, and a licence is issued for it: a licence issued for another installation is refused at import. A backup restore keeps the ID, so a restored installation keeps its licence; recreating the environment creates a new ID, and the new installation needs a new licence. The environment name is only a label, so renaming the environment changes nothing.

The copy control beside the ID copies it. When the card says the ID is Unavailable, the licence service could not verify the installation's identity: no licence is in force, and no activation request can be downloaded. The remedy is to restore the environment's trial sentinel from its backup; ask your platform operator.

Requesting a licence

Download activation request saves the file ankasecure-activation-request-<installationId>.json exactly as the server sends it. Send it to ANKATech to have a licence issued, or renewed, for this installation. The file names the installation ID, the environment name and the release; it is not signed and holds nothing secret. The download is offered only while the installation ID is available.

Knowing what changes at expiry

While the posture is EXPIRED, or no licence and no trial is in effect, the installation is in cryptographic read-only mode. The crypto service refuses every operation that creates new protection or new key material with 402 and the problem type deployment-license-expired: encrypt, sign, sign-encrypt, re-encrypt and re-sign, their streaming forms, key generation, rotation and import, keystore migration and PKCS#7 to JOSE conversion. Its detail reads The deployment license has expired. Contact your platform administrator to renew it.

Decrypt, verify and decrypt-verify, their streaming forms, key reads and listings, key revocation, the algorithm catalogue and the rotation-admissibility preview continue, as does everything on this console that is not a cryptographic operation. The crypto service re-reads the licence state within a minute, so an import restores the refused operations without a restart. The console's own banner and the modal say that cryptographic operations are refused; the operations above are the ones that are.

Reading the licence notice elsewhere in the console

The platform plane shows a licence strip to a viewer holding the permission to read platform alerts: a warning from 60 days before the end date, 15 on a trial; a critical band from 15 days, 5 on a trial; a grace band while in grace; and a read-only band once expired. Only the warning band can be dismissed. Review licence on any band leads here.

Importing a licence

Import license opens a dialog that takes a .ankalic file of at most 64 KB. The console reads it and shows the licence ID, issue date, installation ID, environment, customer, edition, validity and modules it declares before you confirm. It does not compare the installation ID with this installation's: the check that counts is the server's.

An import is refused when the signature does not verify, when the file is signed under a key this release does not trust, when it was issued for another installation, when this licence was already imported, when the installation's own identity cannot be verified, when its validity plus grace has already passed, when it declares a schema version this installation does not admit, or when it names a compliance pack this release does not define. The refusal is shown inside the dialog, which stays open with the file still selected.

After a successful import the dialog reports the installation licensed and the screen re-reads the posture; a licence whose start date has not come is stored and stays inert until that date.

Reading the operation usage

Operation usage summarises the billable operations of the whole installation for this month to date, from the first UTC day of the month through today, and states that period. It shows Total operations, Streaming operations and Non-streaming operations, the same names the Usage screen gives them, a bar whose legend names each part and its count, and Total payload bytes as a size, with the exact byte count when you point at it.

When nothing was recorded, the panel says No usage was recorded in this period; when the summary cannot be read, it says The usage summary could not be read and offers Retry. It is a summary, not a day-by-day table: View detailed usage, at the foot of the panel, opens the Usage screen on the same month by day, where you can also choose any other range and grain.

Reading the licence validation

License validation shows how the cryptographic service checked the deployment licence before admitting each request: Validated on a fresh verdict, Admitted before a verdict was held, Decided on a stale verdict and Refused past the maximum staleness, with the Validation rate as a percentage. A rate below 100 is never shown as 100%.

These counters belong to one instance of the cryptographic service, counted since it started. They are not a total for the deployment, and the next read may answer another instance. When the counters cannot be read, the card shows the problem with the server's detail and Retry, and no counter. The card is shown even when the licence itself cannot be read.

Knowing what the licence decides here

Edition is the one value the platform reads to select what it offers. On a customer-operated installation it decides nothing: a customer's key-material backends are its own, so the edition-tiered backends of the service offering, which the edition would select among, are not offered here. The capability modules, listed as Included or Not included, are informational; nothing reads them. The capacity bar compares the licence's committed key baseline with the active keys of every tenant and states the headroom or over baseline; exceeding it blocks nothing.

The compliance packs decide which packs the platform evaluates your tenants against: every pack of the catalogue during a trial, the packs the licence names while it is in force, grace period included, and none once it has expired. A pack outside them is listed as not included in the licence, its history and remediation plan turn read-only, and evidence already issued for it still verifies but new evidence cannot be issued; no key or crypto operation is allowed or refused because of them.

Reading the compliance packs

The licence lists the compliance packs it was issued with. Each identifier is looked up in this release's pack catalogue: a resolved chip shows the pack's title and opens its definition. On a trial, with no licence imported, every pack of the catalogue is listed, each opening its definition, and the screen states: No license imported yet — this deployment runs on a trial. During the trial every capability module is available and every compliance pack in this release's catalogue is evaluated.

A chip that shows a raw identifier, labelled as not in this release's catalogue and with no link, names a pack this release does not define, typically from a licence issued under an earlier release. The licence stays valid and keeps its state. If the pack catalogue cannot be read, every chip shows its raw identifier with no link, and the screen offers a retry.

To have such a pack resolve, import a licence re-issued with the current pack identifiers, whose start date is not earlier than the current licence's. No environment is recreated and nothing is deleted: the earlier licence stays in history, no longer selected. Importing a licence that names an identifier this release does not define is refused.

How it relates to other screens

The operations an expired licence refuses are the ones the Key Inventory and the crypto API perform; a tenant administrator sees the refusal there, and this is the one screen that ends it.