checkId: check.crypto.license plugin: stellaops.doctor.cryptography severity: warn tags: [crypto, license, compliance]

Crypto Licensing

Runbook — for Stella Ops platform administrators running licensed cryptography providers (CryptoPro CSP and any provider listed in Cryptography:LicensedProviders).

check.crypto.license validates the licensing posture of every configured licensed provider. It runs only when at least one licensed provider is configured (Cryptography:CryptoPro:Enabled=true or a non-empty Cryptography:LicensedProviders array), and warns when a license file is missing or a configured expiry date is in the past or within 30 days.

What it checks

For each configured provider the check inspects:

License file presence. Cryptography:<Provider>:LicensePath (and Cryptography:CryptoPro:LicensePath / Cryptography:CryptoPro:LicenseKey for CryptoPro). A configured path that does not exist on disk is an issue.
Expiry. Cryptography:<Provider>:ExpiryDate (ISO-8601). An elapsed date raises “license has expired”; a date within 30 days raises a “expires in N days” early warning.

When no licensed providers are configured the check returns Info (“No licensed cryptography providers configured”) — never a false Pass.

Symptoms

<provider> license file not found: <path>
<provider> license has expired
<provider> license expires in N days
License path not configured for an enabled provider.

Remediation

Verify the license file. Confirm the file at Cryptography:<Provider>:LicensePath exists and is readable by the service account. Licenses are mounted from the host / Vault, never embedded in an image.
Renew expired licenses. Contact the provider vendor to renew, then replace the license file and update Cryptography:<Provider>:ExpiryDate to match the new term.
Configure the license path. Set Cryptography:<Provider>:LicensePath (for CryptoPro, also Cryptography:CryptoPro:LicenseKey / ExpiryDate) in the service configuration or compose .env.

Verify with:

stella doctor --check check.crypto.license

Notes

Licensing is an offline-first concern: the check reads local configuration and the on-disk license file only — it makes no network call and never contacts a vendor licensing server.
The 30-day expiry warning is a wall-clock comparison intended as an operator-facing early alert, not a deterministic gate.