Keep sslbrain up to date

The appliance, its modules, the agent packages and the service agents are updated separately under Maintenance and support › Updates. Only administrators see the page. Every version is signed by FairSSL, and the signature is checked before the version is installed.

Update the appliance

Take a backup: Save a backup. The appliance does not take a backup of its own before an update.
Open Maintenance and support › Updates and click Check now.
If the page says “This release is signed. The signature is checked again before it is installed.”, click Update now and then Confirm update.
The update starts within a minute. The web interface is unavailable while the new version starts.

If the page says “This release is not signed yet and cannot be installed.”, wait and click Check now later.

If any step of the update fails, the appliance starts again on the version it had. Certificates on your servers are not affected by an update.

See the result

Last update shows the result after every start:

Completed: the appliance runs the new version.
Aborted, the version did not change: the appliance runs the version it had. The reason is in Update log, and what to do about it is in The update fails.
Completed, but with a different version than expected: the appliance runs a different version from the one chosen.
The version was changed outside the appliance’s own update: the version was changed directly on the host.

Choose what updates by itself

Updates › Automation has four switches. A change takes effect a few seconds after you save.

Switch	What it does	When
Appliance updates	Installs a newer signed version of the appliance.	Checks every 4 hours.
Modules	Downloads licence modules and keeps them up to date. A download does not activate a module, see Modules.	Every night at 03:30.
Agent packages	Downloads new versions of agent definitions and service agent packages.	Every night at 03:15.
Automatic agent approval	Approves an agent that checks in with a one-time key or code the appliance issued before 28-09-2026.	When the agent checks in.

Agent packages cannot be switched off while Approve new versions automatically (recommended) is on under Agents › Settings, see Integrations.
A server that connects with an install code from Servers › Install service agent is approved by the code, whatever Automatic agent approval says. A server installed with SERVER alone waits under Servers. See Connect servers.
The Auto or Manual choice during setup only set the switches’ starting value. The card shows Automatic, Manual or Custom depending on how they are set now.
The check for new versions sends nothing to sslbrain Cloud except the appliance’s current version. Pause it under Deployment › Scheduled in the row Opdateringstjek (brain + agenter), which the appliance shows in Danish.

Certificate renewal has no switch. It always runs, every 3 hours, see First certificate on a server. Whether a renewed certificate is deployed by itself is chosen on each rule with Auto-deploy on certificate renewal.

The service agents on your servers

The Service agent updates card on the same page moves the service agents to a version from FairSSL’s signed catalogue. The card has three options: Automatic (recommended), Manual and Off. Only an Owner can change it.

The server checks the signature itself before it installs. If the new version does not check in within 10 minutes, the server reinstalls the version it had.

How to update one server or many: Keep service agents up to date.

Update from the console

If the web interface does not respond, update the virtual appliance from the console in the hypervisor. An appliance in Docker has no console menu.

Open the machine’s console in the hypervisor. Press Enter if the menu is not on the screen.
Choose 6 Update to the latest version. The signature is checked as it is for an update from the web interface.
Wait for WORKED. or FAILED (exit N). Pressing Enter lets the update carry on in the background.

FAILED: the reason is under 4 View logs and then 2 The controller: updates, restarts, signature checks.
The appliance software is broken: 9 Danger zone and then 6 Reinstall the appliance software (data kept) download the running version again and start it afresh. Certificates, settings, accounts and the database are kept.

See Console menu.

Host updates

The Host updates card controls fixes to the virtual machine itself (OVA and qcow2): the console menu, logins, SSH, hardening and the controller. The fixes come with the signed updates.

Security fixes only, automatically (default): security fixes run with the next update. Everything else waits for your approval.
Automatically in the maintenance window: everything runs while the appliance’s maintenance window is open.
Manual only: nothing runs until you have approved it, security fixes included.

Ubuntu on the virtual appliance installs security updates by itself every day. If one of them needs a restart, the machine restarts at 03:00 and the appliance is back within about a minute. If the appliance runs in Docker, you update the host yourself.

New in version 0.4.45

This is what changes when the appliance updates to 0.4.45:

The agent address follows the appliance’s hostname. The install command and the agents’ configuration use the hostname from Network and DNS, or the IP address while there is no hostname. The update removes the saved Direct addresses of the appliance and Advertised Connection URL fields and writes an audit log entry for each address it removes. If a server needs another address, set it on that server’s own page.
Agent protocol v3 beside the current one. The appliance accepts service agents that speak protocol v3. No existing agent switches by itself; they carry on as they do today.
Business Central, SQL Server and LIME on Windows. Discovery finds each Business Central instance, default and named SQL Server instances, and LIME, and each becomes its own target in a rule. This needs the Windows agent windows-os 1.2.0 or later.
Certificate files on Windows. A certificate file target can choose the file format, which users get read and execute access, and which services are restarted, picked from the agent’s own discovery.
Let’s Encrypt profiles. A Let’s Encrypt source can choose an ACME profile, and short-lived certificates renew halfway through their lifetime. DNS validation records are removed when a certificate is cancelled or deleted.

Removed in 0.4.45:

Agents no longer install or manage an ACME client on servers. A rule that uses one of those actions stops, with the reason in the run.
The windows-iis and windows-exchange agents are withdrawn. Use iis8plus and exchange2013-2019, which both find and install the certificates.