# Readium LCP setup

The demo at `/lcp/` encrypts `artliving.epub` and issues signed LCP licenses (`.lcpl`).
It needs one thing from you: a **provider certificate and private key** from EDRLab.
Until they are installed, the page shows "Not configured yet" and the download button is disabled.

## Why you need EDRLab's certificate

Thorium Reader only accepts a license if the signature's certificate chains to the
Readium/EDRLab root certificate built into the app. A self-signed certificate will
encrypt and sign correctly but Thorium will refuse the book ("license signature invalid").
So the certificate must be issued by EDRLab.

## 1. Generate your private key and a certificate request

Run this on any machine with OpenSSL. **Keep `provider.key` secret; never send it to anyone.**

```bash
openssl genrsa -out provider.key 2048

openssl req -new -key provider.key -out provider.csr \
  -subj "/C=<2-letter country>/O=<Your organisation>/CN=<Your provider name>"
```

Example: `-subj "/C=IN/O=Osho International/CN=Osho Play"`.

## 2. Request the certificate from EDRLab

1. Go to <https://www.edrlab.org/software/readium-lcp/> and contact EDRLab
   (<https://www.edrlab.org/contact/>) to get an LCP service account or a test certificate.
2. Send them the **CSR** (`provider.csr`) only.
3. They return a signed certificate (PEM). If you receive a chain (provider + intermediate),
   that is fine; only the first certificate is embedded in each license.

EDRLab also publishes test material in the
[readium-lcp-server](https://github.com/readium/readium-lcp-server) repository, which is
useful for trying things out, but production use needs your own certificate.

## 3. Install the files

Copy them to the server, replacing the empty placeholders:

| File | Location |
|------|----------|
| Signed certificate (PEM) | `/home/oshoplay/lcp-private/certs/provider.crt` |
| Private key (PEM) | `/home/oshoplay/lcp-private/certs/provider.key` |

```bash
chmod 700 /home/oshoplay/lcp-private /home/oshoplay/lcp-private/certs
chmod 600 /home/oshoplay/lcp-private/certs/*
```

If your key is passphrase-protected, set `key_pass` in `/home/oshoplay/lcp-private/config.php`.
Check that they match:

```bash
openssl x509 -noout -modulus -in provider.crt | openssl md5
openssl rsa  -noout -modulus -in provider.key | openssl md5   # must print the same hash
```

Reload `/lcp/`; the banner turns green when both files are valid and matching.

## 4. Settings

All in `/home/oshoplay/lcp-private/config.php` (outside the web root):

- `source_epub`: path of the original EPUB.
- `provider`: URL identifying you as the license provider.
- `base_url`: set only if the site is behind a proxy and URLs come out wrong.
- `demo_passphrase` / `demo_hint`: defaults shown on the page.
- `rights`: print/copy limits written into the license.

The encrypted copy is built on the first request and cached in `lcp-private/store/`.
It is rebuilt automatically if the source EPUB changes.

## 5. Test in Thorium

1. Open `https://<your-domain>/lcp/` and click **Download license (.lcpl)**.
2. Open the file with Thorium (double-click, or File → Open).
3. Thorium downloads the encrypted book from `publication.php` and asks for the passphrase
   (`demo` by default).

The site must be reachable over HTTPS from the machine running Thorium.

## Security notes

- **Move the original EPUB.** `public_html/.well-known/epubs/` is inside the web root. A
  `.htaccess` there denies direct downloads, but the safest place is outside `public_html`
  (for example `/home/oshoplay/lcp-private/source/`); then update `source_epub`.
- This demo shows the passphrase on the page and anyone can get a license. A real shop should
  issue licenses only after purchase, with a per-user passphrase the user chooses.
- Every license reuses one content key per book, which is how LCP works, but anyone who
  knows the passphrase can read the book.

## Limitations

- No LCP **license status server**: licenses cannot be revoked, renewed or loaned, and there
  is no device registration. For that, run EDRLab's `lcpserver` / `lcpencrypt`
  (Go; needs a VPS, not shared hosting).
- Basic profile only; the passphrase hash is SHA-256, as the spec requires.