Installing and operating CertiPOS

This guide summarises the installation and operation of CertiPOS for an IT team. The full installer guide and the cut-over runbook are delivered with the product and kept in step with every release.

What is delivered

• CertiPOS-Server-<version>.exe: the central server. It bundles the .NET 10 runtime, PostgreSQL 16, the service, the portal, the database migrations, a protected secret store and the backup task.
• CertiPOS-Register-<version>.exe: the Windows register, with the drivers helper and the enrolment wizard. An MSIX package, an Android APK and an iOS build are available for managed devices.
• Release notes: every build lists what changed, with its date, and the SHA-256 of each installer.

Installing the server

Run the server installer on a Windows Server 2019 or later machine, or a Windows 10/11 machine for small sites. The installer installs PostgreSQL as a service, provisions the database and its roles, issues or imports the HTTPS certificate, registers the CertiPOS Windows service, schedules the backup task and opens the firewall rule. The first sign-in creates the organisation and its administrator.

Certificates

The server serves HTTPS with a certificate of your choice or one issued by the installer. Every register pins the certificate fingerprint it reads from the enrolment QR code; TLS can be required for every call. HTTP Strict Transport Security and security headers are on by default.

Connecting SAP Business One

In the portal, enter the Service Layer address, the company database and a posting identity. Test the connection, run Provision fields once to add the user-defined fields and tables CertiPOS uses, then run the first master data sync. SAP credentials are stored protected with DPAPI or AES and never leave the server.

Installing registers

Create the register in the portal and generate an enrolment code. On the lane, run the register installer or install the MSIX, open the application and scan the QR code. The device receives its certificate and token, pulls its master data and configuration, and is ready to sell. Android and iPad devices receive the server address, the enrolment code and the certificate fingerprint through managed app configuration.

Optional roles

• Store hub: the server binary in store mode on a LAN machine, for restaurants and multi-register stores that share tables, held tickets and kitchen orders when the WAN is down.
• Connect Agent: the server binary in agent mode next to SAP, when the server cannot reach the Service Layer directly; outbound only.

Operating

• Upgrade: run the new server installer over the old; migrations apply on start. Registers receive builds through the update channel with a staged rollout and a checksum.
• Backups: a scheduled PostgreSQL dump; a restore command rebuilds the database and is proven by the release drill.
• Monitoring: heartbeats, backlog, drawer cash, platform and clock skew per register; alerts by e-mail; health endpoints for your tools.
• Support: support bundles from the portal and the register, never containing a secret; remote actions including a two-administrator wipe.