Save a backup and restore from it

The appliance takes a backup only when an administrator clicks Create backup. It takes none by itself, not even before an update.

Take a backup

Open System › Backup.
Optionally, write a note in the Note (optional) field, for example what you are about to change.
Click Create backup. The backup appears at the top of the list.
Keep a copy off the appliance, see Get a copy off the appliance. Backups are on the same disk as the appliance’s data and are lost with it.

The appliance keeps running while the backup is taken. Take a backup:

before you update the appliance;
after Change the signing key under Agents › Connection, because a backup from before the change cannot serve the agents;
after larger changes to profiles, rules and servers.

A backup holds the whole appliance: the database, the vault with the certificates’ private keys, the appliance’s TLS key, the installation’s identity key and its access to sslbrain Cloud, modules and agent packages.

The appliance keeps the 5 newest backups and the 3 newest it took itself before a restore. Older ones are deleted when a new backup is taken.

Get a copy off the appliance

Click Download next to the backup.
Confirm your login.
Move the file <id>.tar.gz to encrypted storage outside the appliance. The file has no encryption of its own.

Only an Owner can download backups when private key export is set to Nobody or Owner only, see Security. Admin Local cannot download a backup, because it cannot confirm its login. Every download and every refused download is written to the audit log.

Restore from a backup

A restore returns the appliance to the moment of the backup. Everything changed since then is lost.

Open System › Backup. Choose a backup from the version the appliance runs now, or an older one. The Version column shows it. The appliance does not refuse a backup from a newer version.
Click Restore and confirm. The appliance first takes a backup of the current state and restarts.
Open the appliance with the 12 backup words, because sslbrain Cloud does not open the vault after a restore. If the appliance shows Installation locked, click Use backup key instead, see When something does not work. Otherwise use Lost access? Use backup words on the login page.
Check that the certificates under Certificates › Managed by sslbrain and the rules under Deployment › Rules are as they were when the backup was taken. The Backups page does not show whether the restore succeeded.

Service agents get no work until they have answered the appliance’s challenge. Until then the server’s page shows “The appliance was restored from a backup.”

You can only restore from the list on the appliance. A downloaded backup cannot be uploaded. Files that were not in the backup stay where they are.

If it fails

“The backup was not taken.”: there is not enough free space. Free up space or extend the disk, see When something does not work.
The restore does not start: there is no room for the backup of the current state, or the appliance is busy with another action, such as an update.
The restore changes nothing: the backup’s files did not match their checksums, and then the appliance changes nothing.

The 12 backup words

The 12 backup words open the appliance after a restore. Anyone with both a backup and the words can open every certificate’s private key. Keep the words somewhere other than the backup files, see Security.

Move the appliance to another machine

A backup can only be restored on the appliance that took it. To move the appliance to a new machine, move the licence in sslbrain Cloud, see Move or restore the appliance.