sslbrain Cloud
Copy link to the page “sslbrain Cloud”In sslbrain Cloud you activate the appliance, choose a licence, buy units and give colleagues access. The appliance fetches its licence from there. Certificates, private keys and settings stay on the appliance, not in sslbrain Cloud.
Create an account at sslbrain.com/cloud/register with email and password, or with GitHub, Google or Microsoft. Confirm the email address, then sign in at sslbrain.com/cloud/login.
- Two-Factor Auth switches on two-factor authentication. The account can remember trusted devices.
- Notifications holds the email addresses, at most 10, that alerts from the appliance’s E-mail (Cloud) channel go to. If none are listed, they go to the account owner. See Keep an eye on your certificates.
Roles in sslbrain Cloud
Copy link to the section “Roles in sslbrain Cloud”| Role | Can |
|---|---|
| Owner | Everything |
| Administrator | The same as Owner, except renaming the Auto-DNS name |
| Operator | Day-to-day work and certificate setup. Sees licences and the team, nothing to do with payment |
| Viewer | View, not change |
| Billing | Licences, purchases, invoices, the data processing agreement and payment events in the Audit log. No access to appliances |
When you sign in to the appliance with sslbrain Cloud, the role here also sets the role on the appliance. See Users and sign-in.
Appliances
Copy link to the section “Appliances”Appliances shows every appliance activated with the account: hostname, tier, licence, version and last contact. An appliance appears in the list when someone signs in to it with the account and chooses a licence.
Click an appliance to see:
- Overview: appliance id, IP address, registration date, and the Display name the appliance is shown with in the portal.
- Licence: the licence history, and Switch licence to another of the account’s licences. The appliance keeps its identity, data and certificates.
- Certificates: the certificates sslbrain Cloud has issued to the appliance.
- Auto-DNS names: the names the appliance uses for CNAME delegation.
- Danger zone: release the licence. See Move the licence to another appliance.
Only Owner and Administrator can switch and release licences.
Downloads and requirements
Copy link to the section “Downloads and requirements”Downloads and requirements at the bottom of the menu has the files and requirements for a new appliance. Every role except Billing can open the page once the account has accepted the licence terms and the data processing agreement. Your licences shows the licences a new appliance can take.
| File | For |
|---|---|
| OVA | VMware and other hypervisors that import OVF |
| qcow2 | KVM, libvirt and Proxmox |
docker-compose.yml | Docker on your own Linux server |
- Docker: the compose file only starts the appliance. It does not install the host controller, which carries out updates, restarts and restores from the web interface. Use the installation script from FairSSL, which also installs the controller. The appliance answers on port 8443.
- OVA and qcow2: the page lists version, size and SHA-256. The VM image version is the date the image was built. The first time the machine starts, it installs the newest signed version of sslbrain. The OVA and qcow2 files are not signed; the appliance image they fetch is. See Security.
Requirements:
- Virtual appliance: 2 vCPU, 4 GB RAM and 40 GB disk (thin provisioned).
- Docker: Docker 24.0 or newer, Docker Compose v2, 4 GB RAM, 20 GB disk space and access to the CAs’ ACME endpoints.
- Outbound HTTPS (443) to
registry.sslbrain.com,cloud.sslbrain.comandacme.sslbrain.com. - The virtual appliance also needs outbound HTTP (80) to
archive.ubuntu.comandsecurity.ubuntu.comfor operating system security updates. - No inbound ports from the internet.
All ports, including those on your own network, are under Security.
Licences and units
Copy link to the section “Licences and units”A licence belongs to one appliance and sets how much it can manage. There are four tiers: Free, Basic, Professional and Enterprise. First-time setup calls Free “Community”.
| Limit | Free | Basic | Professional | Enterprise |
|---|---|---|---|---|
| Servers | 5 | 25 | 250 | Unlimited |
| Rules | 10 | 50 | 500 | Unlimited |
| Logins | 1 | 3 | 10 | Unlimited |
| Domains per account | 10 | Unlimited | Unlimited | Unlimited |
| Names per certificate | 100 | Unlimited | Unlimited | Unlimited |
| Certificate profiles | 1 | 3 | Unlimited | Unlimited |
| Custom agents | 1 | 3 | Unlimited | Unlimited |
| Feature | From |
|---|---|
| Alerts by E-mail (SMTP) and Webhook | Basic |
| Certificate upload | Basic |
| Service agents via sslbrain Cloud | Professional |
| Maintenance windows | Professional |
| Audit log export | Professional |
| Windows CA | Enterprise, plus an add-on that FairSSL switches on for the licence |
- Servers: the licence covers the oldest servers up to the limit. Servers beyond the limit are deactivated and shown as unlicensed. A new server is never refused.
- Rules: on Free the 11th rule is refused when it is created. A paused rule counts; the appliance’s own rule does not. Nothing that exists stops.
- A paid licence expires: the appliance falls back to Free. The licence becomes a Free licence on the appliance it was on, and cannot be used on another.
Every account has a Free licence from the start. The appliance’s page Appliance and licence › Licence and units opens Licences and units in sslbrain Cloud.
Units pay for the paid certificates sslbrain Cloud issues. One unit is one standard DV certificate. Other products cost more units, depending on the product and the number of names.
- Units are deducted when a paid certificate is issued, and are held by open orders.
- The balance plus the credit limit FairSSL has set must cover the order.
- Buy units creates an invoice straight away. Pay by card or bank transfer.
- Owner, Administrator and Billing can buy.
- The account receives an email when the balance is low.
Which certificates a profile can fetch: Choose where certificates come from.
Give colleagues access to one or more appliances.
-
Open Team and find Add a person.
-
Enter the email address, choose the appliances, and choose the role: Administrator, Operator or Viewer. If the person should only see licences and invoices, choose Billing and no appliance.
-
Click Add.
If the person is already a member of the account, they have access straight away. Otherwise an invitation is sent that is valid for 7 days. It can be resent or revoked.
- The Owner role cannot be assigned.
- Nobody can change their own role.
- Owner and Administrator manage the team. Operator can see it.
The team page shows, for example, “3 of 10 logins”. The count is every user plus pending invitations, across all the account’s appliances. The appliance counts its own logins, see Users and sign-in.
Move the licence to another appliance
Copy link to the section “Move the licence to another appliance”Data does not move with the licence. Certificates, private keys, service agents and settings stay on the appliance you are leaving.
-
Open Appliances in sslbrain Cloud and click the appliance you are leaving.
-
Find the card Move this licence to another machine under Danger zone, and click Release the licence. This needs Owner or Administrator.
-
Type
releaseand click Release it. The appliance keeps running until the new one takes over the licence. -
Set up the new appliance as in First-time setup. When you choose a licence, choose Move the licence from and the name of the appliance you are leaving.
-
Set up the rest as in steps 3 to 8, starting from A name and certificate for the appliance.
When the new appliance takes over the licence, the one you are leaving is retired. It shows This installation has been retired and no longer serves anything. Its local data can still be opened with the 12 backup words.
- When to move, and how to restore on the same machine: Move or restore the appliance.
- To reinstall only the software on the same virtual machine, use 6 Reinstall the appliance software in the console menu. Data is kept, and the licence does not need to move.