Certora Quickstart, as shipped in the download

CERTORA — QUICKSTART
====================

Self-hosted certificate generator + public verification — PHP + MySQL/SQLite.
Verification codes are random unique lookup tokens (no signing, no crypto,
no payments, no personal health data).


REQUIREMENTS
------------
  - PHP 8.0+ with extensions: pdo, pdo_sqlite (or pdo_mysql)
  - MySQL 5.7+ / MariaDB 10+ OR SQLite 3 (SQLite requires no extra setup)
  - A web server (Apache with mod_rewrite, or Nginx with try_files)
  - No Composer packages, no API keys, no external services.


SHARED HOSTING / CPANEL (RECOMMENDED FOR MOST BUYERS)
------------------------------------------------------
1. Upload the contents of the `app/` folder to your web root (e.g. public_html/)
   or a subdirectory (e.g. public_html/certora/).

2. Make sure this directory is writable by PHP:
     data/

   Via cPanel File Manager: right-click -> Permissions -> set to 755 or 775.

3. Visit https://yourdomain.com/install/ in your browser.

4. Fill in the installer:
     - Database: choose MySQL (fill in host/name/user/pass) or SQLite (no setup)
     - Organization name, timezone
     - Your admin name, email + password

5. The installer writes config.php, creates a starter template, and redirects
   you to the login page.

6. Log in, then:
     - Edit your template(s) under Setup > Templates (wording + merge tokens)
     - Set your public verify URL under Setup > Settings (the address where you
       host Certora) so it prints on each certificate
     - Add recipients (Setup > Recipients) or import a CSV
     - Generate certificates, then download PDFs from the Issued register


TRY IT WITH DEMO DATA FIRST
---------------------------
  - On the dashboard, click "Load demo data" for three templates, a batch of
    recipients, and issued certificates (including a revoked example), then
    "Reset all data" when done.
  - Or from the command line:  php bin/demo.php
      (login: admin@certora.app with the one-time password it prints)


RECIPIENT CSV FORMAT
--------------------
  A header row plus one recipient per line. Columns matched by header NAME
  (order doesn't matter). Recognized headers:
     name    (required)  - also: recipient, student, attendee
     course              - also: program, event, training, award
     email   (optional)

  Example:
     name,course,email
     Maya Rivera,Project Management,maya@example.com
     Diego Santos,Project Management,diego@example.com


PUBLIC VERIFICATION
-------------------
  - Anyone can visit  /verify  (no login) and enter a certificate's code, or
    open  /verify/CODE  directly. Dashes and spaces are ignored.
  - A valid code shows the certificate face (recipient, course, template,
    issuer, issue date). A revoked one is shown as revoked. Anything else is a
    plain 404 "not found". Emails are never shown.
  - The endpoint is guarded by a honeypot field and a naive per-IP rate limit.


VPS / SELF-HOSTED (APACHE)
--------------------------
  <VirtualHost *:80>
    DocumentRoot /var/www/certora/app
    <Directory /var/www/certora/app>
      AllowOverride All
      Require all granted
    </Directory>
  </VirtualHost>


DOCKER (QUICK TEST)
-------------------
  docker run --rm -p 8080:8080 \
    -v "$(pwd)/app:/var/www/html" \
    -w /var/www/html \
    php:8.3-cli \
    php -S 0.0.0.0:8080 router.php

  Then visit http://localhost:8080/install/


POST-INSTALL SECURITY CHECKLIST
--------------------------------
  [ ] config.php is protected (the .htaccess does this automatically)
  [ ] data/ is not web-accessible (.htaccess blocks it automatically)
  [ ] Use HTTPS in production
  [ ] Keep PHP updated


LOOKING AFTER IT (from 4.0)
---------------------------
  * Updates: open Updates in the menu, save your license key once, press Check for updates.
    Reaching 4.0 from 3.x is the last update by hand: replace the files; config.php and data/ stay.
  * Sample data: the installer offers to start with a sample; remove it later with one click.
  * Backups: "Back up once a day by itself" is on by default (/restore); add an S3-compatible bucket there for
    a copy somewhere else. The Health page (/health) says whether all of this is working.
  * On Nginx: use the server block in the manual ("On Nginx: keep data/ private", https://ownware.io/p/certora/manual);
    it opens the installer and keeps data/ private.
  * One-line install for technical owners:
    curl -fsSL https://ownware.io/install.sh | sh -s -- certora <your license key>

NOTES
-----
  * A verification code is a random, database-unique alphanumeric lookup token.
    It is NOT a cryptographic signature; verification is a database lookup.
  * Certora issues and verifies certificates only. It does not process payments,
    does not sign or encrypt, and stores no personal health data.
  * Certificates already issued keep the wording they were issued with, even if
    you edit the template afterward.