# keys/

## `public_app_trusted.b64`
The **RSA‑2048 public key (SPKI, base64)** that is embedded in the shipped Convertly apps
(Windows + Android). The apps only accept tokens signed by the **matching private key**.

- This file is **public** — safe to keep in the repo / this pack.
- Use it to **verify** that the server's private key is the correct one
  (`../02-CRYPTO-CONTRACT.md §verify`). A token the server issues must pass verification with this key.

## The private key (NOT in this pack — by design)
- Lives **only on the live server** at `LICENSE_PRIVATE_KEY_PATH` (e.g. `/etc/convertly/license_private.pem`).
- File perms `600`, outside the web root, **never** committed to git, **never** shared.
- It already exists and matches `public_app_trusted.b64` (activation works live).

## ⚠️ Do not regenerate
Running `reference-server-node/genkeys.js` or `openssl genpkey` creates a **new** keypair whose public
key does **not** match the installed apps → every existing installation stops validating. Only rotate
keys together with a **new app release** that embeds the new public key, and re‑ship all apps.