Step 2 of 8

2. First-time setup

The setup wizard links the appliance to your sslbrain Cloud account, gives it a licence and shows the 12 backup words. The wizard has five steps. This page covers the first four. The fifth step, the name, is under A name and certificate for the appliance.

Before you start

The appliance answers in the browser on the address the console or the installation showed, for example https://192.168.1.20.
A login as owner or administrator on your sslbrain Cloud account. Whoever runs the wizard becomes the owner of the appliance.
Somewhere outside the appliance for the 12 backup words, for example paper in a locked cabinet or a password manager.

The browser warns about the appliance’s certificate. That is expected. The certificate is replaced in step 3.

Click Log in with sslbrain Cloud.
Log in to sslbrain Cloud and confirm that the appliance is yours. If you have no account, create one there.
The browser returns to the appliance, and the wizard moves on to the licence by itself.

Choose a licence

Check the line “Signed in as …”. If it is the wrong account, click Wrong account? Log in again.
Choose the licence:
- Free: the Free licence, which covers 5 servers and 10 rules.
- Paid plan: a Basic, Professional or Enterprise licence the account has bought.
- Move the licence from: the appliance takes over the licence from another appliance. See Move or restore the appliance.
Click Use this licence.

If the payment for a paid plan has not been registered yet, the appliance runs on a temporary licence until the date shown. The limits of each licence are under Licences and units.

Store the 12 backup words

Step 3 of the wizard, Emergency key, shows 12 English words. They get you into the appliance’s data when sslbrain Cloud cannot be reached.

Write down the 12 words in order, or click Copy key and store them in a password manager outside the appliance.
Tick I have saved the recovery key somewhere safe. and click Next.

The words also work with Log in with backup words on the login page, and they unlock the appliance after a restore. See Security and Backup.

Choose Auto or Manual

Step 4 of the wizard is called Operation and diagnostics.

Choose Auto or Manual. Neither is selected in advance.
Tick Share diagnostics with FairSSL continuously. if FairSSL may receive diagnostics from the appliance (Share diagnostics with FairSSL).
Leave Automatic (recommended) selected under Service agent updates (Service agent updates).
Click Continue.

Auto turns four switches on and Manual turns them off: Appliance updates, Modules, Agent packages and Automatic agent approval. Afterwards you change them one by one under Updates › Automation. See Keep sslbrain up to date.

A server that connects with an install code is approved by the code with either choice. A server installed without a code waits for an administrator to approve it (Approve new servers). New versions of the agent packages must also be approved under Agents › Settings.

Certificates renew the same way with either choice. Licence modules are downloaded with either choice and activated under Modules.

Share diagnostics with FairSSL

The box is unticked to begin with. If you tick it, the appliance sends logs, errors, agent runs, certificate metadata and configuration to FairSSL about every 15 minutes. Passwords, tokens and private keys are removed before anything is sent.

Afterwards you deselect sections or switch it off under Maintenance and support › Diagnostics. See Support and diagnostics.

Service agent updates

Automatic (recommended): sslbrain updates the agents to the newest version in FairSSL’s signed catalogue by itself, one server first and then a few at a time. If an update fails, the rollout of that version stops.
Manual: an administrator chooses the version and updates from the server’s page or from Servers.

Afterwards only the owner can change the choice, under Updates, which also has the choice Off. See Keep service agents up to date.

Next step

The wizard now shows Step 5 of 5: Access and hostname. Continue with A name and certificate for the appliance.

If it fails

The wizard shows “The appliance could not reach sslbrain Cloud”: the appliance must reach cloud.sslbrain.com, acme.sslbrain.com and registry.sslbrain.com on port 443. Open outbound 443 to the addresses under Addresses for the firewall and try again. Use the names in the firewall if it supports them, because the addresses behind the names can change. See The appliance has no connection to sslbrain Cloud.
The computer with the browser cannot reach sslbrain Cloud: click Copy link and open the link somewhere else, for example on a phone. Log in there. Paste the code under Logged in somewhere else? Paste the code from there: and click Continue with the code.
The wizard sends you back to step 1: the confirmation in sslbrain Cloud is valid for about a day. Log in again.
sslbrain Cloud refuses the login to the appliance: only owners and administrators on the account can confirm an appliance. See Login does not work.
The wizard shows “This account has no licence free right now.”: buy a licence or release an installation in sslbrain Cloud. The list refreshes itself. See The licence.
The wizard asks you to accept the licensing terms and the data processing agreement: do so in sslbrain Cloud and log in again.