Licensing

Cenvero Stratum is licensed per node. A license is a digitally signed document that binds a plan and an expiry to a specific machine. The agent verifies it cryptographically on every boot and re-checks it continuously while running.

Plans

Stratum is licensed per node, billed on the term you choose (monthly or longer). The current plans, their features and rates are shown on the pricing section of the site — plans are configured in the management panel, so this page never carries stale numbers. For large-scale, air-gapped or bespoke arrangements, contact sales.

The self-service plans have no minimum node count. Large fleets, air-gapped, or custom-SLA deployments are arranged as bespoke agreements with sales.

Licenses are never issued automatically. You place an order, follow the payment instructions, and submit your payment proof; an admin verifies it and issues the license, which then appears in your account. There is no instant self-service issuance — every license is tied to a verified order.

Pre-release (beta/RC) licenses

Beta and release-candidate builds run on a separate pre-release track and require a special pre-release license. These are **issued directly by an administrator** — there is no order or payment flow for them — and may be bound to a customer account or left internal (for your own testing), with an admin-set expiry.

The gate is strict, both ways: a normal (stable) license can neither download nor run a beta/RC build, and a pre-release license runs only beta/RC builds — not stable. The channel is written into the signed license, so the agent enforces it offline and fails closed (refuses to operate) on a mismatch. See Upgrades → Release channels for the build/release side.

How a license is bound

When you activate, the agent computes a hardware ID by hashing stable machine identifiers (CPU, motherboard, primary NIC MAC, and disk serial). The issued license is signed over that hardware ID, so a license file copied to a different machine simply will not verify there.

sudo cenvero-str-ctl license activate CNVR-XXXX-XXXX-XXXX-XXXX
cenvero-str-ctl license status

plan         enterprise
serial       7F3A-21C9-...
issued_to    acme-corp
hardware_id  9b2c… (matches this host)
valid_until  2026-07-04T00:00:00Z
state        active   (27 days remaining)

The trust chain

Licenses are signed through a two-tier Ed25519 chain whose root public key is compiled into the agent:

An offline root key (held by Cenvero, never online) signs an

intermediate key that lives on the license server.

The intermediate may auto-sign short licenses only — up to three months

(90 days). Longer terms are signed offline by the root directly.

The agent independently enforces that cap: a license longer than the intermediate is allowed to issue is rejected even if its signature is valid. This means a compromised license server cannot mint long-lived licenses.

Enforcement: warn → grace → freeze

Stratum never hard-stops your network. Existing endpoints, forwarding, DHCP, DNS, and the firewall keep working regardless of license state. Enforcement only governs changes, and it escalates gently:

State	When	Effect
Active	License valid	Everything works normally
Warning	≤ 7 days to expiry	Full functionality; renewal reminders logged
Grace	≤ 14 days after expiry	Full functionality continues; renew now
Frozen	Past grace, or revoked, or a tampered/invalid signing chain	Existing traffic keeps running; new or changing operations are blocked until you renew

In the Frozen state, commands that mutate state (creating networks, attaching endpoints, editing the firewall) return exit code 4. Read-only commands and the data plane are unaffected.

Revocation (CRL)

The agent periodically fetches a signed Certificate Revocation List. If your license serial appears on it, the node moves to Frozen. The CRL is itself signed, so a hostile or spoofed server cannot "un-revoke" a license by serving an empty list. The CRL also carries a monotonic sequence number, so a stale CRL cannot be replayed to roll a revocation back.

Offline and air-gapped nodes

Nodes do not need continuous connectivity. The signed license bundle and the last-seen CRL are cached in /var/lib/cenvero-str/, so an isolated node keeps running on its cached license. Air-gapped operation with offline activation is available for bespoke deployments — contact sales.

Renewing

# After renewing in the panel, pull the refreshed license + CRL
sudo cenvero-str-ctl license refresh

A node in Warning, Grace, or Frozen returns to Active the moment it receives a valid, longer-dated license.

Coupons and invoices

If you have a coupon code, enter it when you place your order — the discount is applied to the order total once the code is validated (it must be active, in date, within its usage limits, and applicable to your plan). Each code can be percentage- or fixed-amount.

When an administrator verifies your payment, a PDF invoice is generated automatically and appears under Invoices in your account, where you can view or download it any time. There is one invoice per paid order.

Next steps

Installation — activation during setup.
Upgrades — keeping the agent current.