Every on-premise Versus install is unlocked by a cryptographically signed license. There are two ways to apply one — an offline, file-based path that works fully air-gapped, and a one-click online path for connected installs. This guide covers both, what happens if the appliance loses connectivity, and how license metering works.
Both paths produce the same thing: a signed .veslic license bound to your install. The license is verified entirely offline against a keyring built into the product — a license server is never required to run Versus. Online activation is a convenience for fetching and refreshing that file, not a runtime dependency.
For air-gapped or restricted networks. You copy an install fingerprint out, receive a .veslic file, and upload it. No outbound connectivity is ever required.
For connected installs. You paste a single activation code; the install fetches its license and then keeps itself current — renewals apply automatically and revocations are honored.
Both are offered on the same screen — Versus Platform → System → Licensing in the Versus admin console. If your appliance has no route to the internet, use the offline path; everything still works.
Use this on any install, and always on air-gapped ones. You hand Versus your install fingerprint, receive a license file node-locked to that fingerprint, and apply it.
In the admin console, go to Versus Platform → System → Licensing. The page shows your current license state and the Install fingerprint.
Click Copy next to the fingerprint — a stable, non-secret identifier for this install used to node-lock the license so it can't be copied to another host.
Provide the fingerprint to Versus through the portal or your account team. You'll receive a .veslic token bound to it. (A self-service trial issues an unbound .veslic that binds to the first fingerprint it's applied to.)
Back on Versus Platform → System → Licensing, under Apply a license, paste the token and click Apply License.
The install verifies the Ed25519 signature against its embedded keyring, checks the validity window and fingerprint match, and unlocks your licensed modules. No network call is made.
When your term is renewed or your entitlement changes, you'll receive a new .veslic for the same fingerprint. Apply it the same way — the newest valid license supersedes the previous one. No reinstall, no downtime.
For installs that can reach the Versus Licensing Service, activation is a single code entry, and the install then keeps its own license current.
VERSUS_LICENSE_SERVER environment variable (production https://license.versus-one.com; staging https://license.versus-demo.com). When it isn't set, Activate online is hidden and you use the offline path above.On a connected install, the Activate online panel appears above the file-upload option.
Paste the code from your order — it looks like VS-XXXX-XXXX-XXXX — and click Activate.
Versus sends the code plus this install's fingerprint to the Licensing Service, which returns a .veslic bound to your node. It's applied automatically — same verified storage as the offline path.
The install periodically checks in (a lightweight heartbeat, ~daily). Renewals and upgrades apply automatically; a revocation is honored on the next check. Force one anytime with Check now.
Under the hood, the two calls the install makes are:
POST https://license.versus-one.com/api/activation/v1/activate
{ "activation_code": "VS-XXXX-XXXX-XXXX", "install_fingerprint": "…" }
→ { "license_token": "<.veslic>", "validate_after_seconds": 86400 }
POST https://license.versus-one.com/api/activation/v1/validate (periodic heartbeat)
{ "license_id": "…", "install_fingerprint": "…", "nonce": "…" }
→ { "state": "valid", "revoked": false, "superseding_token": null }Online activation depends on reaching the Licensing Service, but Versus is deliberately built so a loss of connectivity never takes the product down. What happens depends on when the outage occurs.
If the appliance can't reach the service when you click Activate, activation can't complete and nothing is applied. Use the offline path instead — obtain a .veslic for your fingerprint over any channel and upload it. The result is identical.
Nothing changes for your users. The install already runs from its signed .veslic. The heartbeat just can't reach the server, so pending renewals/revocations pause — they aren't lost — and reconcile automatically when connectivity returns (or on Check now).
.veslic via the offline path.In short: fail-open on the network, fail-closed only on cryptography. An unreachable server never locks you out; only an expired/revoked license or a tampered response does.
A Versus license doesn't just unlock modules — it can also carry limits that meter how much of a module you may use, measured in managed units:
| Module | Metered unit | Example limit |
|---|---|---|
| TLS / CLM | Managed certificates | max_certificates |
| ADC | Managed devices (load balancers) | max_devices |
| Firewall | Managed firewalls | max_firewalls |
| IPAM / DDI | Managed IP objects / zones | max_ip_objects |
| Platform | Connected collectors | max_collectors |
Limits are encoded in the signed license and enforced locally — no server call is needed, so metering works air-gapped exactly like feature-gating. As you approach a cap you're warned; at the cap, the action that would exceed it (e.g. adding one more device) is blocked, while everything you already manage keeps working. By default Versus meters devices and collectors; other counts are advisory unless your license says otherwise. A limit never causes a mid-incident shutdown — it only gates growth past what you licensed.
A connected install includes a small usage summary — counts only, e.g. { devices: 42, collectors: 3 }, never configuration or PII — on its periodic heartbeat. That gives your account team visibility for renewals and lets Versus true up a growing estate: if you need more units, sales issues a superseding license with higher limits, and it applies automatically on the next check-in (online) or by uploading the new .veslic (offline). Air-gapped installs report nothing over the network — their metering is purely local.
You can see your current limits and where you stand against them any time on Versus Platform → System → Licensing. Metering is about capacity, separate from the module on/off entitlement — a license grants a set of modules and a size for each metered one.
The Versus Platform → System → Licensing page shows a state chip:
| State | What it means |
|---|---|
| Active | Valid and within its term. All licensed modules are unlocked. |
| In grace period | Term ended but a grace window (default 14 days) keeps the system fully functional with a banner. Renew before it ends. |
| Expired | Past the grace window. The system becomes read-only — view and report, but no changes. Applying a valid license restores it immediately. |
| Revoked | Revoked at the source (connected installs pick this up on heartbeat). The system goes read-only; contact your account team. |
.veslic (offline) or click Check now after a renewal (online) to restore full function.VERSUS_LICENSE_SERVER configured (treated as air-gapped). Use the offline file-based path, or have an administrator set the server URL.