Skip to content
Docs sslbrain sslbrain.com

Servers sslbrain does not know

Copy link to the page “Servers sslbrain does not know”

If no package in the catalogue covers your application, you write the installation script yourselves and upload it as a custom agent. sslbrain issues and renews the certificate, and your script installs it.

When you need this

Copy link to the section “When you need this”
  • The application reads its certificate from a file, a keystore or the Windows certificate store, and no package in the catalogue knows it.
  • The application must be restarted or given a command after the certificate is replaced, which the catalogue’s packages do not do.

The server needs a service agent. The script always runs on the server, so a system that can only be reached through an API from the appliance cannot be covered.

Write the script and upload it

Copy link to the section “Write the script and upload it”

  1. Find out where the application reads the certificate, in which format, and how it loads it again.

  2. Write agent.yml and the script in PowerShell, bash or Python. Start from the example for Linux, see Windows servers for Windows, and choose the format with cert_format (variables).

  3. Test the script by hand on a test server with a test certificate.

  4. Upload the agent under Agents › Catalogue › Custom agents (Upload a custom agent). This needs the Owner role.

  5. Allow custom agents on the server (Allow the script on the server).

  6. Create the rule as in step 8. In the Services step, choose one of the services discovery has found on the server, such as IIS or RDP (Choose the services). Services cannot be added by hand, so if discovery has found none, the server cannot be chosen.

  7. In the Summary step, click Add agent under Agent chain for … and choose your custom agent. sslbrain then runs the agents in the chain instead of the service’s own package.

Allow the script on the server

Copy link to the section “Allow the script on the server”

A service agent does not run custom agents with its default setting. Set the agent’s script policy to 31 on every Windows server that is to run the script. Use the MSI property SCRIPTPOLICY=31 at installation, or Group Policy, which also reaches servers added to the same OU later (The service agent’s script policy).

Signing

Copy link to the section “Signing”

The appliance signs your custom agent when it is uploaded. If you change the script, upload a new version, because the service agent does not run a script whose signature does not match (Signing).

Check that it works

Copy link to the section “Check that it works”

Run the rule and check the certificate on the server as in step 8. If the run fails, the script’s output is under Deployment › Runs (Deployment fails).