Certora quickstart: install in minutes

CERTORA — QUICKSTART
====================

Self-hosted certificate generator + public verification — PHP + MySQL/SQLite.
Verification codes are random unique lookup tokens (no signing, no crypto,
no payments, no personal health data).


REQUIREMENTS
------------
  - PHP 8.0+ with extensions: pdo, pdo_sqlite (or pdo_mysql)
  - MySQL 5.7+ / MariaDB 10+ OR SQLite 3 (SQLite requires no extra setup)
  - A web server (Apache with mod_rewrite, or Nginx with try_files)
  - No Composer packages, no API keys, no external services.


SHARED HOSTING / CPANEL (RECOMMENDED FOR MOST BUYERS)
------------------------------------------------------
1. Upload the contents of the `app/` folder to your web root (e.g. public_html/)
   or a subdirectory (e.g. public_html/certora/).

2. Make sure this directory is writable by PHP:
     data/

   Via cPanel File Manager: right-click -> Permissions -> set to 755 or 775.

3. Visit https://yourdomain.com/install/ in your browser.

4. Fill in the installer:
     - Database: choose MySQL (fill in host/name/user/pass) or SQLite (no setup)
     - Organization name, timezone
     - Your admin name, email + password

5. The installer writes config.php, creates a starter template, and redirects
   you to the login page.

6. Log in, then:
     - Edit your template(s) under Setup > Templates (wording + merge tokens)
     - Set your public verify URL under Setup > Settings (the address where you
       host Certora) so it prints on each certificate
     - Add recipients (Setup > Recipients) or import a CSV
     - Generate certificates, then download PDFs from the Issued register


TRY IT WITH DEMO DATA FIRST
---------------------------
  - On the dashboard, click "Load demo data" for three templates, a batch of
    recipients, and issued certificates (including a revoked example), then
    "Reset all data" when done.
  - Or from the command line:  php bin/demo.php
      (login: admin@certora.app / admin123)


RECIPIENT CSV FORMAT
--------------------
  A header row plus one recipient per line. Columns matched by header NAME
  (order doesn't matter). Recognised headers:
     name    (required)  - also: recipient, student, attendee
     course              - also: program, event, training, award
     email   (optional)

  Example:
     name,course,email
     Maya Rivera,Project Management,maya@example.com
     Diego Santos,Project Management,diego@example.com


PUBLIC VERIFICATION
-------------------
  - Anyone can visit  /verify  (no login) and enter a certificate's code, or
    open  /verify/CODE  directly. Dashes and spaces are ignored.
  - A valid code shows the certificate face (recipient, course, template,
    issuer, issue date). A revoked one is shown as revoked. Anything else is a
    plain 404 "not found". Emails are never shown.
  - The endpoint is guarded by a honeypot field and a naive per-IP rate limit.


VPS / SELF-HOSTED (APACHE)
--------------------------
  <VirtualHost *:80>
    DocumentRoot /var/www/certora/app
    <Directory /var/www/certora/app>
      AllowOverride All
      Require all granted
    </Directory>
  </VirtualHost>


DOCKER (QUICK TEST)
-------------------
  docker run --rm -p 8080:8080 \
    -v "$(pwd)/app:/var/www/html" \
    -w /var/www/html \
    php:8.3-cli \
    php -S 0.0.0.0:8080 router.php

  Then visit http://localhost:8080/install/


POST-INSTALL SECURITY CHECKLIST
--------------------------------
  [ ] config.php is protected (the .htaccess does this automatically)
  [ ] data/ is not web-accessible (.htaccess blocks it automatically)
  [ ] Use HTTPS in production
  [ ] Keep PHP updated


NOTES
-----
  * A verification code is a random, database-unique alphanumeric lookup token.
    It is NOT a cryptographic signature; verification is a database lookup.
  * Certora issues and verifies certificates only. It does not process payments,
    does not sign or encrypt, and stores no personal health data.
  * Certificates already issued keep the wording they were issued with, even if
    you edit the template afterwards.