Support and diagnostics

FairSSL has no access to the appliance. Support gets what you send yourself: a support bundle, continuous diagnostics, or SSH for 24 hours. Write to FairSSL support at info@fairssl.dk.

Support bundle

A support bundle is a JSON file with what support needs to find a fault. Only administrators can download and send it.

Open Maintenance and support › Support.
Click Send to sslbrain Cloud and confirm with Yes, send to sslbrain Cloud. If the appliance cannot reach sslbrain Cloud, click Download support bundle and send the file sslbrain-debug-<date>-<time>.json to info@fairssl.dk.
Tell support what is wrong. The bundle’s reference is shown under Support bundles sent.

The bundle is sent only when someone clicks the button.

Hostnames and IP addresses stay in the bundle. If they must not leave your network, click Download support bundle and go through the file before you send it.

The bundle contains system information, database migration status, the queue, open orders, storage use, recent deployments with the agents’ output, the stages of agent tasks, rule runs, agent versions, the last 100 lines of the application log, and every setting.

Removed before download and sending are known secret values, encrypted settings (shown as [ENCRYPTED]), settings with names such as password, secret, key, api_token and hmac (shown as [REDACTED]), and text that looks like passwords, tokens, private keys, Bearer and Basic headers, and connection strings.

Support partner

A support partner is an IT partner who becomes the account’s support contact in sslbrain Cloud and can pass your cases on to FairSSL. The partner gets no access to the appliance.

Get an invite code from the partner.
Open the Support partner tab under Maintenance and support › Support.
Enter the code in Invite code and choose an expiry date at most 10 years ahead.
Click Approve.

Revoke access cancels the approval in sslbrain Cloud and on the appliance. Only administrators can approve and revoke.

Diagnostics

With diagnostics on, the appliance continuously sends selected information to FairSSL, so support can see a fault without asking you for a bundle. Diagnostics are off until an administrator switches on Share diagnostics with FairSSL under Maintenance and support › Diagnostics. If you ticked Share diagnostics with FairSSL continuously during setup, they are on for every section.

While diagnostics are on:

the chosen sections are sent to sslbrain Cloud about every 15 minutes, signed and over HTTPS;
passwords, tokens, API keys and private keys are removed on the appliance before anything is sent;
the appliance logs at debug level for as long as the application log is shared;
FairSSL deletes the data it receives after 30 days.

If you switch diagnostics off, nothing more is sent, and anything waiting is deleted.

You choose the sections:

Section	Contents
Application log	New lines from the appliance’s own log and the process logs
Service agent runs	Tasks sent to service agents: type, status, times, and the agent’s hostname, OS version and version
Push agent runs	Deployments without a service agent: agent and version, endpoint, action, status, exit code and duration
Error log	Only the error lines from the same logs
Certificate metadata	Name, SAN, issuer, serial number, validity, key type and fingerprint. Never private keys
Certificate sources	Which sources are set up, and how, without passwords and API keys
Server inventory	Server name, hostname, IP address, operating system and connection status
Automation	The rules’ strategy, maintenance window, and whether renewed certificates are deployed automatically
Appliance health	Memory, CPU and disk hour by hour, start-ups, upgrades, and processes that have crashed. No hostnames, domains, IP addresses or certificates

Temporary SSH for support

On the virtual appliance (OVA and qcow2) you can open SSH for 24 hours so FairSSL support can log in. An appliance in Docker does not have this option.

Open the virtual machine’s console in the hypervisor.
Choose 9 Danger zone, then 2 Temporary SSH for support.
Answer yes to “Open temporary SSH for 24 hours?”.
Give support the appliance’s address. It is shown under 1 Status. Support must be able to reach it on port 22 or 10022.

SSH accepts only the FairSSL support keys built into the image, never a password. Support logs in as root. SSH closes itself after 24 hours, also if the machine is restarted. Close it early from the same screen.

SSH is off by default and cannot be opened remotely or from the web interface.

Appliance and licence

System › Appliance and licence has three tabs:

Tab	Who	Shows
Overview	Everyone	The licence, the Audit log card, Maintenance window, and the appliance’s hostname, version, connection to sslbrain Cloud, last heartbeat, installation date and identity
System	Administrators	Status, Restart, Stop sslbrain and Recent activity with the last 50 system actions
Licence and units	Administrators	Opens Licences and units in sslbrain Cloud, see sslbrain Cloud

Restart restarts sslbrain, and the page reconnects by itself. Stop sslbrain stops sslbrain, but not the operating system.