Step 3 of 8

3. A name and certificate for the appliance

The appliance needs a name so that browsers and service agents trust its certificate. You choose the name in the wizard’s last step, Access and hostname. Choose the free name. sslbrain then orders a trusted certificate by itself.

The free name

Free my.sslbrain.net hostname is selected by default. The name becomes <name>.my.sslbrain.net and points at the appliance’s address on your network.

Keep the suggestion or change the name part. It must have 6-10 characters, lowercase letters and digits only, at least one letter and no hyphen.
Check IP address for the DNS name. It is the private IPv4 address clients reach the appliance on. If the appliance runs in Docker, it is the Docker host’s address.
Click Complete setup and go to dashboard.

sslbrain orders the certificate straight away. There is nothing more for you to do.

The name points at a private address, so it only works from inside your network. If the appliance answers on a port other than 443, the port must be part of the address, for example https://<name>.my.sslbrain.net:8443.

The appliance’s own certificate

sslbrain creates an ordinary rule by itself that orders, installs and renews the appliance’s certificate (Renewal). sslbrain Cloud handles domain validation and orders from Let’s Encrypt, or from Google Trust Services if that fails.

The rule’s server is the appliance itself. It is listed under Servers with the badge This appliance, does not count towards the licence and cannot be deleted.

Your own name

A name in your own domain, for example sslbrain.example.com, gets a trusted certificate once domain validation is ready. Until then the appliance uses a self-signed certificate.

Choose Own domain, enter the full name and click Complete setup and go to dashboard.
Create an A record for the name in your DNS, pointing at the appliance’s address.
Get domain validation ready with a CNAME delegation or a DNS API credential (step 6).
Open Network and DNS › Network. Under Certifikatkilde, choose Your own domain with a certificate profile and choose the profile, for example Default (sslbrain Cloud).
Create the record the Validating the name box shows:
```
_acme-challenge.sslbrain.example.com  CNAME  <your Auto-DNS name>
```
If a DNS API credential already covers the zone, or the profile is from Windows CA, the record is not needed.
Click Test DNS and then Gem TLS-kilde.

You can save before the record exists. The appliance issues the certificate once the record answers.

Skip

With Skip, you use the appliance on its IP address with a self-signed certificate, and the browser warns every time. Choose a name when you are ready (Change the name or certificate later).

The wizard logs you in and goes to the dashboard. The first time you log in with email and password, the appliance stores the password. Until then, logging in needs sslbrain Cloud to be reachable. Create a local password so you can get in when sslbrain Cloud is down (Local password).

Check that it works

Open https://<name>.my.sslbrain.net or your own name from a machine on the network. The browser shows no warning.
Certificates › Managed by sslbrain shows the appliance’s certificate with the name.

Change the name or certificate later

Open Network and DNS › Network.

The name is chosen under Værtsnavn & HTTPS-certifikat. Click Gem og aktiver værtsnavn.
The certificate is chosen under Certifikatkilde. Click Gem TLS-kilde.

The choices under Certifikatkilde:

Self-signed certificate (default): the appliance’s own certificate. The rule for the appliance’s certificate is paused.
Manual upload (server.crt + server.key): a certificate and a private key that match. The rule is paused, and sslbrain does not renew the certificate.
Free name under .my.sslbrain.net (sslbrain handles validation): needs a connection to sslbrain Cloud. The rule runs again.
Your own domain with a certificate profile: as in Your own name. The rule runs again.

Each sslbrain Cloud account can get three new free names a week. A change of name counts.

If it fails

The name does not resolve, or the certificate does not arrive: the appliance must have a connection to sslbrain Cloud. See No connection to sslbrain Cloud.
The wizard completed with a warning about the rule: the rule for the appliance’s certificate could not be created. The appliance tries again once a day.
Your own name is not validated: check the _acme-challenge record with Test DNS. See Domain validation fails.
The rule for the appliance’s certificate fails: open the rule under Deployment › Rules and look at the run. See Installation fails.
The browser still warns after Skip: that is expected until the appliance has a name.