Step 8 of 8

8. First certificate on a server

A deploy rule decides which certificate is installed on which services, and renews it automatically. The rule orders the certificate, installs it on the services you choose, and installs it again every time the certificate is renewed. The service agent does not install certificates by itself; it carries out the rule.

Before you start

The server is connected (step 5), and discovery has run on it (discovery on the server).
The names in the certificate are covered by a CNAME delegation or a DNS API credential (step 6).
You have the administrator or operator role.

Create the rule

Open Deployment › Rules and click Create rule. If you come from Create rule on the server’s row under Servers or from the server’s page, the wizard is open with the server and the services its service agent found selected. If the server is missing in the wizard’s first step, add a device without an agent with Add device, or open Install service agent in a new tab. What you have chosen in the wizard is kept. If you come from Create a certificate for … in step 6, the wizard is open with the names filled in.
In the Services step, choose the services that should get the certificate (choose the services).
In the Certificate step, choose New certificate. If the certificate is already in sslbrain, choose Use an existing certificate.
Choose the profile under Profile, for example Gratis Auto (step 7). If there is only one, it is already selected.
Check Names: one name per line, and the first becomes the CN. A certificate can have up to 100 names, including wildcards such as *.example.dk.
The Domain validation panel should show that every name is covered. If a name is not covered, fix it in step 6 before you go on.
In the Summary step, give the rule a Rule name. If the rule installs on IIS bindings, choose Sequential under Strategy.
Click Save and deploy now. The rule waits for the certificate and installs it when it has been issued.

The IIS package cannot confirm the installation. With the default strategy, the run therefore shows as Failed even though the certificate is installed. Check the installation as under Check that it works. The other settings are under Rule settings.

Choose the services

The Services step shows servers with their services. Search with Search servers…, or filter by OS and role.

Open a server to see its services. An IIS binding is shown as ip:port:hostname.
If a server shows No discovery, click Run discovery. The list updates once the service agent has reported the result.
If the appliance itself needs the certificate, choose the service on the server This appliance (the appliance’s certificate).

Discovery decides which package installs, for example iis8plus for an IIS binding and exchange2013-2019 for Exchange. The packages are listed in Integrations.

Check that it works

The rule’s page shows First rollout until a day after the certificate is installed on all of the rule’s services: Certificate ordered, Certificate issued and Installed on the services, with See the result, which opens the run. If a step fails, it says so at the step. Get started on the home page ticks Certificate installed once a run has installed a certificate on one of your servers.

A green run means that sslbrain has recorded the installation. It does not show that the server delivers the certificate. Check that on the server.

Open the certificate under Certificates › Managed by sslbrain. Note the Serial and expiry date of the latest version under Versions.
Fetch the certificate from the server as a client sees it. Use the name in the certificate and the service’s port, 443 for a web server.
- bash
- PowerShell
Terminal window
openssl s_client -connect <servername>:<port> -servername <servername> </dev/null 2>/dev/null \ | openssl x509 -noout -serial -enddate
Terminal window
$name = '<servername>' $tcp = [Net.Sockets.TcpClient]::new($name, <port>) $ssl = [Net.Security.SslStream]::new($tcp.GetStream(), $false, { $true }) $ssl.AuthenticateAsClient($name) $cert = [Security.Cryptography.X509Certificates.X509Certificate2]::new($ssl.RemoteCertificate) $cert.SerialNumber; $cert.NotAfter $ssl.Dispose(); $tcp.Dispose()
In a browser: open the address, click the padlock by the address bar, and view the certificate.
If the serial and expiry match sslbrain, the server is delivering the certificate.

You can also scan the server from the appliance with TLS scanning.

Follow the run

The Runs card on the rule’s page shows each run with its status. View run opens the details, with every step under Troubleshooting. Execute rule starts a run. The statuses that need explaining:

Waiting for certificate: the certificate has been ordered but not issued yet.
Partial: some services succeeded, others failed.
Skipped: the service was skipped, for example because the server is not covered by the licence.

Deployment › Runs shows every installation across rules. Run again repeats a single installation.

Renewal

sslbrain checks every 3 hours which certificates are due for renewal. There is no setting for it.

Certificate lifetime	Renewed
90 days or less	When two thirds of the lifetime has passed; for a 90-day certificate, about 30 days before expiry
Longer than 90 days	30 days before expiry
All	No later than 7 days before expiry

The rule installs the renewed version if the rule is active and Auto-deploy on certificate renewal is on. It does so within the maintenance window.

Scheduled

Deployment › Scheduled shows the certificate sources’ runs and the row Opdateringstjek (brain + agenter), which runs every 4 hours and can be paused. Renewals are not listed here (renewal).

If it fails

The run stays at Waiting for certificate, or the certificate is not issued: see Validation fails.
The run shows Failed, but the certificate is installed on IIS: choose Sequential under Strategy in the rule.
The run shows Failed or Partial: open the run and read the error code under Troubleshooting. See Deployment fails.
The server still delivers the earlier certificate after a green run: the service uses a different certificate from the one the package replaced. Run discovery on the server again and check that the right binding is selected in the rule.
The eleventh rule is refused: the Free licence has room for 10 rules (licences).
The certificate is not renewed in time: see Renewal fails.

Rule settings

Setting	Default	Meaning
Strategy	One at a time with verification	Installs on one service at a time and waits for the installation to be confirmed. The other choices are Sequential and Parallel
Failure policy	Retry, roll back on failure	Tries again, and rolls back to the certificate that was there before if it still fails
Auto-deploy on certificate renewal	On	The renewed version is installed automatically
Maintenance window	The appliance’s window from Appliance and licence › Overview, or any time	Limits when the rule may install. A window on the rule applies instead of the appliance’s. Needs Professional or Enterprise (maintenance windows)
Follow thumbprint (IIS)	On	After the first installation, the certificate is replaced everywhere on the server it is used