Is it possible to use HTTPS certificates for licensing?

Question

I am working on an application with multiple clients and a server running various web-services for the clients. To implement licensing I am thinking about using HTTPS as a protocol for the web-services using certificates that are issued by our company. By influencing the expiration date of a certificate for a client we can prevent them from using our software after their license term.

It this possible and does it make sense to you?

---

Additional information: I am planning on using Qt/C++ for the clients, and the Twisted framework for the web-services.

Answer 1

I don't think that will work, the client can opt to ignore any certificate errors, check out the RemoteCertificateValidationCallback event in System.Net.Security

http://msdn.microsoft.com/en-us/library/system.net.security.remotecertificatevalidationcallback.aspx

Answer 2

It should work. I don't know Twisted well, but you can place an Apache proxy in front of the web service, and have that handle certificate based authentication.

As for the client side, watch this bug. libcurl should provide you with an escape route if Qt gives problems.

You'll need to think through the procedures around the CA, to make sure this works operationally: Are your sales and billing departments comfortable with issuing a hard cut-off date to each customer? Will the certificate be issued on purchase order, or payment of invoice?