Policy and audit
Copy link to the page “Policy and audit”Policy and audit holds the operation mode, the script policy, the domain lock and the audit log.
Operation mode
Copy link to the section “Operation mode”The operation mode decides whether the appliance installs updates, downloads modules and agent packages, and approves new agents by itself. Certificates are always renewed, whatever the operation mode.
You choose it once, in step 4 of first-time setup, Operation and diagnostics. Nothing is preselected.
- Auto switches all four on. The appliance downloads straight away.
- Manual switches none of them on. The agent versions that ship with the appliance are approved in the name of the person who made the choice.
After setup, the four switches Appliance updates, Modules, Agent packages and Automatic agent approval are what counts. Change them under Updates › Automation, see Keep sslbrain up to date.
Policy and audit › Operation mode shows the starting choice and its date, the switches under Automation now, and whether the appliance shares diagnostics with FairSSL. The page cannot be changed and is for administrators only.
Share diagnostics with FairSSL continuously in step 4 is a separate choice and is not ticked by default, see Support and diagnostics.
Scripts on the servers
Copy link to the section “Scripts on the servers”Which scripts a service agent runs is decided on the server. The choice under Allowed scripts on Policy and audit › Script policy is not sent to the agents.
The agent checks the signature of every script before it runs. It runs only the types its script policy allows. The default is 15: scripts from FairSSL and community scripts, but not your own custom agents. The catalogue has no community scripts today.
For a Windows server to run a custom agent, set its script policy to 31 on the server. Do it in one of two ways:
- Add
SCRIPTPOLICY=31to the msiexec command at installation, see MSI properties. - Set the value
ScriptPolicywith a GPO inHKLM\SOFTWARE\Policies\sslbrain.
The appliance cannot change the script policy remotely. Devices without an agent have no script policy. The numbers are under Script policy values.
Download new versions automatically and Approve new versions automatically (recommended) under Agents › Settings decide whether new versions of the agent packages are downloaded and put into use on their own. Approval can only be on while downloading is on. If you switch approval off, the versions running now are approved in your name. New versions then wait under Agents › Catalogue until an administrator approves them. See Integrations.
Custom agents are described under Your own scripts and Servers sslbrain does not know.
Domain limit on Free
Copy link to the section “Domain limit on Free”On Free, an sslbrain Cloud account can have certificates for at most 2 registrable domains, across all the account’s appliances. A certificate can have at most 100 names. Basic, Professional and Enterprise have no limit.
If the account already has certificates for more domains, they keep renewing. Only a new domain is refused.
A registrable domain is, for example, example.com. www.example.com and mail.example.com count as the same domain.
sslbrain Cloud does the counting when a certificate is ordered. There is no lock period. The number of domains on the account decides whether the order goes through, whatever Policy and audit › Domain lock shows.
Audit log
Copy link to the section “Audit log”The audit log is under Policy and audit › Audit log, and every role can see it. It shows every change and every sign-in on the appliance.
What is logged, how long the log is kept, and how to export it is under Audit and compliance. The rows are linked, see The hash chain.
Script policy values
Copy link to the section “Script policy values”The script policy is the sum of the types the agent may run:
| Value | Allows |
|---|---|
| 1 | Scripts from FairSSL that read |
| 2 | Scripts from FairSSL that make changes |
| 4 | Community scripts that read |
| 8 | Community scripts that make changes |
| 16 | Custom agents that you have uploaded yourself |
The values 4 and 8 exist in the script policy, but the catalogue has no community packages today. Every package in the catalogue is written, reviewed and signed by FairSSL. A suggestion from a user becomes a package only after FairSSL has reviewed it, locked the code and released it under FairSSL’s signature.