Proxies and private CAs

Enterprise networks often terminate and re-encrypt TLS at an inspecting proxy, so the service's certificate arrives re-signed by the company's private CA. The SDK always verifies TLS. There is deliberately no option to disable certificate verification, so these environments need the company CA supplied explicitly.

Native: ca_cert_file

client->set_metadata("ca_cert_file", "corp-proxy-ca.pem");

This adds an extra trust bundle for the TLS layer (PEM format; one or many CAs concatenated) alongside the system trust store. Server verification stays on; this only widens which CAs are acceptable for the TLS connection.

.NET: bring your own HttpClient

The .NET client takes an optional HttpClient, so your corporate TLS policy plugs in through the standard .NET mechanism:

var handler = new HttpClientHandler();
handler.ClientCertificateOptions = ClientCertificateOption.Manual;
// configure handler.ServerCertificateCustomValidationCallback / proxy per your
// company policy, then:
var client = new LicensingClient("https://lm.sws.softactivate.com", new HttpClient(handler));

Dim handler As New HttpClientHandler()
' configure the handler per your company policy, then:
Dim client As New LicensingClient("https://lm.sws.softactivate.com", New HttpClient(handler))

System proxy settings are honored by default in both cases; explicit proxy configuration also goes through the handler in .NET.

Two kinds of trust

TLS trust (this page) and license trust are separate by design:

• ca_cert_file, or your own HttpClient, affect only the transport: whether the HTTPS connection is accepted.
• The SDK's built-in license trust affects only whether a license validates.

A corporate proxy cannot forge a license. The worst a hostile network can do is make activation fail; it can never make a bad license pass.

trusted_domain, and when to set it

trusted_domain defaults to the endpoint host. For the hosted service, set it to sws.softactivate.com, since the endpoint itself is https://lm.sws.softactivate.com. Self-hosted servers usually leave the default in place.

Offline note

Machines that can never reach the service, not even through a proxy, do not need this page: use the offline activation exchange instead, which involves no connection at all.