From 4171649bd3079175984d91f8c90fc78c21351607 Mon Sep 17 00:00:00 2001
From: max <maxi2003.eibl@gmail.com>
Date: Thu, 24 Sep 2026 17:37:59 +0200
Subject: [PATCH] docs: document activated .lic packages, mTLS license sync,
 and renewal seat expansion

---
 README.md | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/README.md b/README.md
index 9662864..548dbb0 100644
--- a/README.md
+++ b/README.md
@@ -104,13 +104,14 @@ graph TB
   - `OID_LOGAR_SEATS (1.3.6.1.4.1.59999.1.1)`: Embeds the exact licensed seat quota directly inside the signed Subordinate CA certificate.
   - `OID_LOGAR_LICENSE_ID (1.3.6.1.4.1.59999.1.2)`: Uniquely tracks enterprise license entitlement.
   - `OID_LOGAR_ISSUER_URL (1.3.6.1.4.1.59999.1.3)`: Embedded endpoint coordinate (`https://logar.eibl.tech`).
-- **Exportable `.lic` Request Files**:
-  - The LOGAR server generates its Subordinate CA private key (`certs/ca.key`), Certificate Signing Request (`certs/ca.csr`), and packages them into an exportable `logar_server.lic` file containing the CSR, server fingerprint, and license authority coordinate.
-  - Exportable directly from the WebUI or via CLI (`python src/Server.py --export-lic server.lic`).
-- **One-Time Pass & Zero-Touch mTLS Renewals**:
-  - The signed CA certificate only needs to be imported **once** into the LOGAR Server (via WebUI or CLI `--import-ca`).
-  - Once imported, the server hub's background watchdog monitors `ca.crt` expiration (< 30 days).
-  - Renewals are performed **automatically over mTLS**: the LOGAR Server authenticates directly against `https://logar.eibl.tech/api/license/renew` using its existing active certificate and key, receives the renewed Subordinate CA certificate preserving its seat quota, and reloads its in-flight `ssl.SSLContext` without dropping client connections or restarting services.
+- **Exportable `.lic` Request & Activated `.lic` Packages**:
+  - **Request**: The LOGAR server generates its Subordinate CA private key (`certs/ca.key`), Certificate Signing Request (`certs/ca.csr`), and packages them into an exportable `logar_server.lic` file.
+  - **Activation Package**: The master license authority issues an activated `.lic` package containing the signed Subordinate CA, granted seat quota, server metadata, and the Master Root CA (`upstream_ca.crt`).
+  - Importable via WebUI or CLI (`python src/Server.py --import-lic activated.lic` or `--import-ca`).
+- **Self-Updating Client Servers & Dynamic Seat Expansion**:
+  - Client servers update themselves against the master authority (`logar.eibl.tech`) over mTLS (`python src/Server.py --sync-license` or via WebUI / automated watchdog).
+  - Seat quotas can be increased with each renewal or updated on-demand on the master authority.
+  - The client server automatically detects the higher seat count in the signed certificate's OID, updates its database and runtime configuration, and reloads its in-flight `ssl.SSLContext` without dropping client connections or restarting services.
 
 ### 3. Integrated Fleet Licensing & WebUI Dashboard
 - **WebUI URL**: Accessible at `http://<server_host>:8443/webui` (or `/`).
@@ -118,8 +119,8 @@ graph TB
 - **Licensing Actions**:
   - 1-click **Export .lic Request** file download.
   - Interactive **View & Copy CA CSR** modal.
-  - Drag-and-drop or paste **Import Signed CA Certificate** modal.
-  - **Renew via mTLS Now** button for immediate upstream renewal.
+  - Drag-and-drop or paste **Import License (.lic / ca.crt)** modal.
+  - **Sync & Renew via mTLS** button for immediate upstream synchronization and seat expansion.
 - **Seat Management & Revocation Table**:
   - Lists all connected Windows and Linux edge forwarders.
   - **Revoke Seat**: Instantly drops and blocks the client at the TLS socket handshake layer.