Download and install

About ten minutes, most of it Setup installing prerequisites by itself.

1. Download the installer

1. Start a free trial (no card) or buy a plan. You get an email with your license key and a sign-in link.
2. Sign in to your account. There's no password: enter your email and click the link we send you. The link works once, for a short time.
3. Under NeverLapse Cert, click Windows (or Linux for the Linux and Docker package) to download the current version. Older versions are listed below it if you ever need one.

2. Run Setup

The file is NeverLapse-Cert-Setup.exe (the version is in its properties: right-click > Properties > Details). Copy it to the Windows server that will run NeverLapse, right-click it and choose Run as administrator.

The screens:

Installation folder

Default C:\Program Files\NeverLapse. Change it only if you have a reason to.

Web Site

• Host name people will use (optional): the DNS name you'll open NeverLapse by, such as certs.yourcompany.com. Blank uses the server's own name. You can change it later under Settings > Server address.
• Port: 443 by default. Pick another only if something else on this server already uses 443. Agents use the same port.
• Certificate thumbprint: leave blank and Setup creates a self-signed certificate (your browser warns until you replace it, which NeverLapse can do for you later; see Web server certificate). To use a trusted certificate from the start, import it into Local Computer > Personal first and paste its thumbprint here.

This screen only shows on a new install. Upgrades keep the address, port and certificate.

Service Account

• Local System (recommended) is right for most setups.
• A different account: pick this only if the NeverLapse service itself should reach other Windows servers or a Windows DNS server with a domain identity, instead of stored logins per host (Windows push hosts and Windows DNS exist only on a Windows server). Enter DOMAIN\username and its password; Setup checks them and grants the account the "Log on as a service" right. That account still needs admin rights on the servers it reaches.

Database

• Install SQL Server Express on this server (default; Setup gets the current free version from Microsoft, SQL Server 2025 Express at the time of writing): Setup does everything, including a database login with a random password that's stored encrypted. The SQL instance is named NEVERLAPSE and only accepts connections from this server.
• Use an existing SQL Server: three more screens follow.
  • Database Connection: the server (SERVER or SERVER\INSTANCE) and database name (default NeverLapse). If the database doesn't exist, Setup offers to create it.
  • Database Authentication: SQL Server Authentication (simplest) or Windows Authentication. Windows Authentication uses the service account: for Local System that's the computer account DOMAIN\SERVERNAME$, which needs a SQL login first.
  • SQL Server Login: the login and password (SQL Server Authentication only).
  Setup tests the connection and won't continue until the server, the database and the login all work. If the database name is wrong it lists the databases that do exist.

Ready to install

Setup shows what it will install, then installs the prerequisites first (the .NET runtimes, SQL Server Express if chosen), then NeverLapse. Each step shows its progress. If a prerequisite fails, Setup stops with the reason before copying any NeverLapse files. Its log is in C:\ProgramData\NeverLapse\logs.

At the end, leave Open NeverLapse in your browser ticked and click Finish.

What gets installed

• Two Windows services: NeverLapse Cert Web (the web console, service name NeverLapseWeb) and NeverLapse Cert (renewals, deployments, agents, service name NeverLapse).
• A Windows Firewall rule for the web port.
• If chosen: SQL Server Express, instance NEVERLAPSE.
• Data and logs in C:\ProgramData\NeverLapse.

Silent install

For scripted installs, run Setup with:

NeverLapse-Cert-Setup.exe /VERYSILENT /SUPPRESSMSGBOXES

A silent install takes every default, including SQL Server Express and a self-signed certificate on port 443.

Security software (SentinelOne, CrowdStrike, ThreatLocker...)

Endpoint security that hooks into Windows Installer can make the SQL Server Express step fail without raising any alert. We've seen it with SentinelOne: halfway through, the Windows Installer service stops accepting work and every remaining SQL package fails (Windows logs error 1719, "The Windows Installer Service could not be accessed").

• Setup handles the common case itself: it restarts the Windows Installer service and resumes SQL Setup, up to three times.
• If it still fails, the message names the security software it found. Pause that product while Setup runs (SentinelOne: unload the agent), or add an interoperability exclusion for C:\Windows\System32\msiexec.exe (SentinelOne: Exclusions > Path, mode Interoperability), then run Setup again. It continues where it stopped.
• Application control (ThreatLocker and similar) in secure mode needs the SQL Server Express setup and NeverLapse allowed, or learning/installation mode while Setup runs. Our installers are signed by Live Information Technology Consulting Group, LLC.
• Or install SQL Server yourself first and pick use an existing SQL Server in Setup.

Server without internet

The .NET runtimes are inside the installer. For SQL Server Express, download SQLEXPR_x64_ENU.exe from Microsoft on another machine and put it next to the NeverLapse installer. NeverLapse itself still needs to reach Let's Encrypt, your DNS provider and the license server to issue certificates (ask support about an offline license if the server can't reach us).