Step 5 of 8 · Updates
Keep service agents up to date
Copy link to the page “Keep service agents up to date”The appliance updates the service agent on your servers with versions from FairSSL’s signed catalogue. The server checks the signature itself before installing.
Choose how the agents are updated
Copy link to the section “Choose how the agents are updated”Choose on the Service agent updates card under Updates. Only the owner can change it.
- Automatic (recommended): sslbrain updates one server first. If that succeeds, at most 10 % of the agents on the same platform are updated at a time, once an hour. Only agents that have checked in within the last 15 minutes are included. If an update fails, the rollout of that version stops.
- Manual: an administrator updates from the server’s page or from the server list.
- Off: sslbrain sends no updates to the service agents.
The card also shows the versions in the catalogue: Catalog: Windows … · Linux …. The Agent packages switch under Updates › Automation updates the packages, such as IIS or Exchange, not the service agent itself.
Update one server
Copy link to the section “Update one server”-
Open the server under Servers.
-
Choose the version under Version in the Service agent panel, and click Update.
-
Confirm.
The server fetches the update the next time the agent checks in, and the service restarts. The panel ends with, for example, “Updated from 1.3.2 to 1.3.3”.
Update many servers at once
Copy link to the section “Update many servers at once”-
Open Servers and select the servers.
-
Click Update service agents and confirm.
The selected servers are updated to the newest version in the catalogue. The appliance replies with how many updates were sent and how many were skipped.
The first time, the appliance may ask to download and activate FairSSL’s update agent. Click Download, activate and update or Activate and update.
If an update does not succeed
Copy link to the section “If an update does not succeed”The server rolls back by itself. If the new version does not check in within 10 minutes, the server reinstalls the version it was running before. The appliance shows “Update to … rolled back to …” after 15 minutes.
An update the agent has not fetched within 24 hours is abandoned.
Agents that cannot be updated from the appliance
Copy link to the section “Agents that cannot be updated from the appliance”The Windows agent from version 1.3.1 can be updated from the appliance. These agents cannot:
- The Windows agent in version 1.1.x and 1.2.x. The server’s page shows “This service agent cannot update itself”.
- A Windows agent that reaches the appliance only through sslbrain Cloud (Updating agents through sslbrain Cloud).
Update them on the server with the newest MSI file. The address, the enrolment and the settings are kept:
msiexec /i https://sslbrain.com/agent.msi /qn /norestartIf the server cannot reach sslbrain.com, download the MSI file under Servers › Install service agent, and run msiexec /i sslbrain-agent.msi /qn /norestart in the folder that holds the file.
Agents installed without an install code
Copy link to the section “Agents installed without an install code”The server’s page shows Installed with an install code or “The agent is installed without an install code”.
An agent installed without an install code, with SERVER alone or with the registration token the appliance had before 28-09-2026, moves itself over to an install code from Windows agent version 1.3.3. It keeps its agent ID, its server, its rules and its settings. After that it follows Agents › Connection and can use sslbrain Cloud (How the agent reaches the appliance).
The agent does not move itself if it runs with IGNORETLS=1, or if it has never pinned the appliance’s certificate. Install it again with an install code (Connect the server). The Create an install code button in the Service agent panel opens Install service agent. The server’s rules and certificates are kept.
If the move does not finish within two hours, the agent carries on as it was installed and tries again later.
If it fails
Copy link to the section “If it fails”- “sslbrain has not fetched FairSSL’s catalog of service agent versions yet.”: the appliance must be connected to sslbrain Cloud. The catalogue is fetched every hour.
- “Service agent updates are off.”: the owner must choose Manual or Automatic under Updates.
- “The update agent is not in the agent catalogue”: the appliance could not fetch the update agent from sslbrain Cloud. Try again later.
- Status “rolled back”: the new version did not check in within 10 minutes. See
update-msiexec-<version>-<time>.logand the agent’s log on the server (Log files). - The agent does not fetch the update: A service agent does not check in.