Integrations
Copy link to the page “Integrations”An integration is a place sslbrain installs certificates: a service on a server, a device or a cloud service. Search, or filter by operating system and type. Each card opens the integration’s guide with the steps, ports and access it needs. The packages and versions your appliance has are under Agents › Definitions.
All integrations
Copy link to the section “All integrations” Operating system
Type
Showing 74 of 74 integrations
- Linux basics The service agent finds Nginx and Apache and runs the service’s product package on the Linux server.
- Windows basics Certificate Store import and discovery, IIS Central Certificate Store and PFX, PEM, DER and JKS files on Windows servers.
- AD FS Replaces the SSL and service communications certificate in Active Directory Federation Services.
- Akamai CPS Uploads the certificate and chain to a third-party enrollment in Akamai CPS.
- Apache HTTP Server Finds loaded TLS VirtualHosts and replaces the selected RSA or ECDSA certificate with a checked reload.
- Apache Tomcat Installs the selected certificate alias in Tomcat’s PKCS12 or JKS keystore and restarts only the selected service.
- Aruba/HPE ClearPass Renews HTTPS and RADIUS/EAP certificates on selected ClearPass cluster nodes and roles, preserving other services.
- AWS Certificate Manager Imports the certificate into ACM. Services that use the certificate's ARN get the new one on reimport.
- AWS CloudFront Imports the certificate into ACM in us-east-1 and puts it on the distribution.
- AWS ELB & API Gateway Installs certificates on ALB/NLB and API Gateway with ACM import, TLS verification and rollback.
- Azure App Service Uploads the certificate to a web app and binds it to its custom host names.
- Azure Application Gateway Renews certificates on selected Azure Application Gateway listeners via PFX or Key Vault, with TLS checks and rollback.
- Azure Front Door Renews certificates on selected Azure Front Door custom domains through Key Vault, with TLS checks and rollback.
- Azure Key Vault Imports the certificate as a new version into Azure Key Vault.
- Barracuda CloudGen Firewall Sets the VPN service's default certificate in CloudGen and finds certificates in firewall and Control Center stores.
- Barracuda Web Application Firewall Installs and renews the certificate on an HTTPS service or one SNI domain in Barracuda WAF, with a TLS check and automatic rollback.
- Bunny.net CDN Installs and renews public-CA certificates on selected pull-zone hostnames.
- Check Point HTTPS Inspection Renews inbound HTTPS Inspection certificates and the separately authorized outbound CA through the Management API.
- Cisco ASA / ASAv Renews the selected ASA interface certificate for AnyConnect/Secure Client VPN and ASDM with TLS checks and rollback.
- Cisco ISE Installs system certificates with selected roles on one Cisco ISE node and checks the certificate’s SHA-256.
- Cisco Secure Firewall (FDM) Uploads or renews certificate objects and binds them to the Web UI, RA VPN and the other targets discovery found.
- Cisco Secure Firewall (FMC) Renews RA VPN identity certificates and known-key decryption certificates on FTD devices managed by Cisco FMC.
- Citrix NetScaler / ADC Updates cert-key pairs and vserver bindings and saves the configuration.
- Cloudflare Discovers zones and uploads or renews the selected custom certificate.
- Dell iDRAC Renews the iDRAC HTTPS certificate using the method advertised by its firmware and checks the served identity.
- Dovecot Installs the certificate for the selected Dovecot service and checks it locally over TLS or STARTTLS.
- Dynamics NAV / Business Central Replaces the HTTP.sys bindings of the NAV and Business Central service instances.
- F5 BIG-IP Installs the certificate and key, repoints client-ssl profiles and syncs HA.
- Fortinet FortiADC Renews the certificate on a FortiADC virtual server and FortiADC's management HTTPS certificate through the REST API.
- Fortinet FortiGate Imports the certificate and swaps the admin, SSL-VPN and IPsec certificate references.
- Fortinet FortiMail Deploys certificates through the FortiMail command line, as its REST API cannot upload certificates.
- Fortinet FortiManager Installs FortiManager's own HTTPS certificate, or the admin HTTPS or SSL VPN certificate of a managed FortiGate.
- Fortinet FortiNAC Renews the certificate of one FortiNAC target, Admin UI, portal, Persistent Agent, RADIUS (EAP) or RadSec, via the REST API.
- Fortinet FortiWeb WAF Renews CA certificates on selected FortiWeb server policies and SNI policies with TLS verification and rollback.
- Google Cloud Certificate Manager Creates or replaces the certificate in Google Cloud Certificate Manager.
- HAProxy Finds HAProxy certificate bundles, validates the certificate and key, and checks activation locally.
- HPE iLO Renews the iLO HTTPS certificate through Redfish using a path selected by firmware version.
- HTTP.sys bindings (netsh) Binds certificates to services that use HTTP.sys without IIS.
- Infoblox NIOS Grid Manager Installs and renews the Grid Manager and WAPI HTTPS certificate on the Grid members you select.
- Ivanti Connect Secure Installs the VPN device certificate on selected ports with TLS verification and automatic recovery.
- Juniper SRX / vSRX Replaces the J-Web HTTPS certificate through Junos CLI over SSH with commit confirmed and a served-certificate check.
- Kemp LoadMaster Uploads certificates and switches the bindings of LoadMaster's virtual services.
- Kubernetes Renews Kubernetes TLS Secrets and JKS/PKCS12 stores and checks the certificate served by the Ingress or application.
- Microsoft Exchange Replaces the certificate on Exchange services, IIS bindings and send and receive connectors.
- Microsoft IIS Installs and binds certificates on IIS websites and FTP sites.
- Microsoft SQL Server Binds the certificate to a SQL Server instance and gives the service account access to the key.
- Milestone XProtect Finds XProtect services, versions and certificate bindings. Installs no certificates.
- NetApp ONTAP Replaces the certificate on the web services of a data SVM.
- Network Policy Server (NPS) Renews the certificate NPS uses for PEAP and EAP-TLS in the network policies you select, restarting only IAS.
- Nginx Finds active TLS server blocks and replaces certificate and key with local activation checks.
- OPNsense Renews the Web GUI certificate automatically and retains the previous certificate for rollback.
- Oracle WebLogic Installs the identity under the configured WebLogic alias and can activate one local server supervised by systemd.
- Palo Alto Networks PAN-OS Imports the certificate and key, repoints SSL/TLS service profiles and commits.
- pfSense Imports the certificate into pfSense and can put it on the webGUI.
- Postfix Replaces Postfix TLS files for SMTP and reloads after validation.
- PostgreSQL Replaces TLS files for the selected PostgreSQL instance and checks its local certificate.
- Proxmox Backup Server Renews and installs the HTTPS certificate on Proxmox Backup Server through its API.
- Proxmox Mail Gateway Renews and installs the HTTPS certificate on Proxmox Mail Gateway through its API.
- Proxmox VE Renews and installs the HTTPS certificate on Proxmox VE through its API.
- Remote Desktop (RDP) Puts the certificate on the RDP listener, so Remote Desktop shows a valid certificate.
- SharePoint Server Subscription Edition Installs and renews certificates on selected HTTPS zones through SharePoint farm certificate management.
- SonicWall SonicOS Installs a certificate and key on SonicWall and selects it for HTTPS management and SSL VPN.
- Sophos Firewall Installs a separate certificate and can select it for the admin console, API and associated portals.
- Synology DSM Uploads the certificate to DSM and replaces the existing one with the same description.
- Traefik Rotates the selected Traefik service certificate with TLS verification, backup and rollback.
- TrueNAS SCALE / CORE Renews the TrueNAS Web UI certificate through its API and checks the active certificate chain.
- Ubiquiti UniFi Renews management certificates on UniFi OS and classic UniFi Network controllers over SSH with verified recovery.
- Veeam Cloud Connect (provider) Installs and renews the Veeam provider's Cloud Connect certificate for gateways via the service agent on the backup server.
- VMware Avi / NSX ALB Renews certificates on selected Avi virtual services and the Controller portal through REST API.
- VMware ESXi Replaces the host certificate on standalone ESXi hosts.
- VMware vCenter Renews vCenter Machine SSL or one selected managed ESXi host through vCenter.
- WatchGuard Firebox Renews local Firebox certificates through SSH; the Cloud API uploads and installs, with certificate selection in the Cloud UI.
- Web Application Proxy Replaces certificates on the WAP federation listener, selected published applications, or both.
- Windows CA (AD CS) Installs a new CA certificate in AD CS. Issuing certificates from your CA is the Windows CA source.
No integration matches the search and filters.
How packages run
Copy link to the section “How packages run”| Platform | Where the package runs |
|---|---|
| Windows servers | On the server, through the service agent (Windows servers) |
| Linux servers | On the server, through the service agent (Linux servers) |
| Cloud services, firewalls, load balancers, storage and vCenter | On the appliance, which calls the device’s API with the credential from Credentials (API) |
| pfSense and VMware ESXi | On the device, over SSH |
| Fortinet FortiMail | On the appliance, which drives the FortiMail command line over SSH |
- When a server has an approved service agent, everything on that server runs through the agent. The agent collects the task at its next check-in.
- Discovery on the server picks the package for each service. An IIS binding gets
iis8plus, Exchange getsexchange2013-2019. You choose the services in the rule (step 8). - FairSSL signs every package. The appliance and the service agent check the signature before the package runs (signing).
Agents › Definitions
Copy link to the section “Agents › Definitions”Shows the packages the appliance has, what they can do, and which version is installed. All users can see the page. Which versions may run is controlled under Agents › Settings.
Agents › Catalogue
Copy link to the section “Agents › Catalogue”The page is called Agent catalogue and is for administrators. It shows each package’s versions, their signature (Verified, Invalid or Unsigned) and the version that is running (Runs …).
- Preview shows the script.
- Import approves a version. Upgrade moves to a newer one.
- Custom agents is for your own scripts (Your own scripts).
Agents › Settings
Copy link to the section “Agents › Settings”The page is called Agent settings and is for administrators. It decides how updated versions of the packages reach the servers.
- Approve new versions automatically (recommended): the packages always run the latest signed version, including packages you approved by hand. The signature is checked before use. The switch also turns on Download new versions automatically.
- Download new versions automatically: downloads new versions of the packages and the service agent’s installation packages from sslbrain Cloud. They appear in Agents › Catalogue, so you can review them before you approve.
If you turn off Approve new versions automatically (recommended), the versions running now are approved in your name, so the rules keep running. Later versions run only once an administrator approves them in Agents › Catalogue.
The operation mode chosen during setup set the starting value: Auto turns automatic approval on, Manual turns it off.
Packages that only find certificates
Copy link to the section “Packages that only find certificates”Milestone XProtect and Veeam Backup & Replication have packages that find services and certificates but do not install them. They are in the overview with the label Finds certificates only, and their certificates show under Certificates › Found on servers. IIS and Exchange also have a package that only finds; it belongs to the integration’s card, together with the package that installs.
Platforms not in the catalogue
Copy link to the section “Platforms not in the catalogue”Upload your own script as a custom agent. See Your own scripts and Servers sslbrain does not know.