Licensing
Cenvero Stratum is licensed per node. A license is a digitally signed document that binds a plan and an expiry to a specific machine. The agent verifies it cryptographically on every boot and re-checks it continuously while running.
Plans
Stratum is licensed per node, billed on the term you choose (monthly or longer). The current plans, their features and rates are shown on the pricing section of the site — plans are configured in the management panel, so this page never carries stale numbers. For large-scale, air-gapped or bespoke arrangements, contact sales.
The self-service plans have no minimum node count. Large fleets, air-gapped, or custom-SLA deployments are arranged as bespoke agreements with sales.
Licenses are never issued automatically. You place an order, follow the payment instructions, and submit your payment proof; an admin verifies it and issues the license, which then appears in your account. There is no instant self-service issuance — every license is tied to a verified order.
Pre-release (beta/RC) licenses
Beta and release-candidate builds run on a separate pre-release track and require a special pre-release license. These are **issued directly by an administrator** — there is no order or payment flow for them — and may be bound to a customer account or left internal (for your own testing), with an admin-set expiry.
The gate is strict, both ways: a normal (stable) license can neither download nor run a beta/RC build, and a pre-release license runs only beta/RC builds — not stable. The channel is written into the signed license, so the agent enforces it offline and fails closed (refuses to operate) on a mismatch. See Upgrades → Release channels for the build/release side.
How a license is bound
When you activate, the agent computes a hardware ID by hashing stable machine identifiers (CPU, motherboard, primary NIC MAC, and disk serial). The issued license is signed over that hardware ID, so a license file copied to a different machine simply will not verify there.
sudo cenvero-str-ctl license activate CNVR-XXXX-XXXX-XXXX-XXXX
cenvero-str-ctl license status
plan enterprise
serial 7F3A-21C9-...
issued_to acme-corp
hardware_id 9b2c… (matches this host)
valid_until 2026-07-04T00:00:00Z
state active (27 days remaining)
The trust chain
Licenses are signed through a two-tier Ed25519 chain whose root public key is compiled into the agent:
- An offline root key (held by Cenvero, never online) signs an
- The intermediate may auto-sign short licenses only — up to three months
The agent independently enforces that cap: a license longer than the intermediate is allowed to issue is rejected even if its signature is valid. This means a compromised license server cannot mint long-lived licenses.
Enforcement: warn → grace → freeze
Stratum never hard-stops your network. Existing endpoints, forwarding, DHCP, DNS, and the firewall keep working regardless of license state. Enforcement only governs changes, and it escalates gently:
| State | When | Effect |
|---|---|---|
| Active | License valid | Everything works normally |
| Warning | ≤ 7 days to expiry | Full functionality; renewal reminders logged |
| Grace | ≤ 14 days after expiry | Full functionality continues; renew now |
| Frozen | Past grace, or revoked, or a tampered/invalid signing chain | Existing traffic keeps running; new or changing operations are blocked until you renew |
In the Frozen state, commands that mutate state (creating networks, attaching
endpoints, editing the firewall) return exit code 4. Read-only commands and the
data plane are unaffected.
Revocation (CRL)
The agent periodically fetches a signed Certificate Revocation List. If your license serial appears on it, the node moves to Frozen. The CRL is itself signed, so a hostile or spoofed server cannot "un-revoke" a license by serving an empty list. The CRL also carries a monotonic sequence number, so a stale CRL cannot be replayed to roll a revocation back.
Offline and air-gapped nodes
Nodes do not need continuous connectivity. The signed license bundle and the
last-seen CRL are cached in /var/lib/cenvero-str/, so an isolated node keeps
running on its cached license. Air-gapped operation with offline activation is
available for bespoke deployments — contact sales.
Renewing
# After renewing in the panel, pull the refreshed license + CRL
sudo cenvero-str-ctl license refresh
A node in Warning, Grace, or Frozen returns to Active the moment it receives a valid, longer-dated license.
Coupons and invoices
If you have a coupon code, enter it when you place your order — the discount is applied to the order total once the code is validated (it must be active, in date, within its usage limits, and applicable to your plan). Each code can be percentage- or fixed-amount.
When an administrator verifies your payment, a PDF invoice is generated automatically and appears under Invoices in your account, where you can view or download it any time. There is one invoice per paid order.
Next steps
- Installation — activation during setup.
- Upgrades — keeping the agent current.