license-managent-system/docs/MIGRATION.md

Migration from the embedded reference server

1. Deploy the standalone platform with a persistent data volume, a new LICENSE_MASTER_KEY, and bootstrap credentials.
2. Sign in as administrator.
3. In Schlüsselverwaltung, open Bestehende Schlüsselpaare sicher importieren and provide the existing issuer and lease private keys plus their original key IDs. This action is write-once.
4. Download GET /api/v1/trust-store and update the public trust store embedded in each product build.
5. Register existing, still-valid license tokens through one of these routes:
   • POST /api/v1/licenses/import with {"token":"...","customerUserId":"optional"};
   • legacy-compatible POST /v1/admin/licenses with {"token":"..."};
   • the existing local licenseweb, pointed at the new platform URL and management bearer token.
6. Set LICENSE_PUBLIC_URL to the stable external HTTPS URL. Newly issued hybrid/online licenses will contain this URL as a signed claim.
7. Existing licenses without verification.serverUrl continue to work when clients receive LICENSE_SERVER_URL or well-known discovery.

Do not generate new keys when migrating existing licenses. A new issuer key would make old tokens unverifiable unless both old and new public keys are retained in the product trust store.