License Expiration Monitoring and Rotation

As your license is approaching expiration, warnings will be written to the Windows event log on the server running the Keyfactor Command service 60 days, 30 days and 5 days in advance of the license expiration (or at the next start of the Keyfactor Command service that falls within these time periods) using event ID 1001.

Figure 417: License Expiration Event Log

New primary Keyfactor Command licenses may be updated on the Licenses page of the Keyfactor Command Management Portal (see Licensing).

Tip:  An error message of "Denied by Policy Module" with "Class is not licensed for use 0x80040112" on an attempt to enroll against a CAClosed A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA. running the Keyfactor CA Policy Module can be an indication that the license for the policy module has expired.

New licenses for the Keyfactor CA Policy Module should be installed on the CA where the policy module is installed as follows:

  1. On the CA where the policy module is installed, open the Certification Authority management tool.
  2. In the Certification Authority management tool, right-click the CA name at the top of the tree and choose Properties.
  3. In the Properties dialog for the CA on the CA Policy Module tab, confirm that the Keyfactor Custom Policy Module is the selected module and click Properties.

  4. On the Licensing tab of the Policy Module Configuration Properties page, click Upload License and browse to locate the license file provided to you by Keyfactor. This file should have the extension CMSLICENSE.

    Figure 418: Upload a New Keyfactor Command License

  5. Click OK as many times as needed to close the configuration dialogs and save the configuration.
  6. Restart the CA services.