Skip to content
Docs sslbrain sslbrain.com

When something does not work

Copy link to the page “When something does not work”

Each section starts with what the appliance shows. Some messages are shown in Danish only; those are quoted in Danish here, or described where the Danish text cannot be reproduced. If a section does not solve the problem, send a support bundle to FairSSL.

The appliance cannot open its keys

Copy link to the section “The appliance cannot open its keys”

What you see: After a restart, logging in with sslbrain Cloud gives “Cloud authentication is currently unavailable. Try again or use emergency access.”

Cause: The vault holding the certificates’ private keys is opened with a key from sslbrain Cloud, and the appliance cannot reach sslbrain Cloud. Cloud connection under Appliance and licence › Overview shows this.

How to fix it: Restore the connection, see sslbrain Cloud cannot be reached. The vault then opens by itself.

To get in before then, click Lost access? Use backup words on the login page. Enter the 12 backup words in Backup words and click Log in with backup words. You are now signed in as Admin Local, see Security. Wrong words give “Invalid backup key.”

Installation locked

Copy link to the section “Installation locked”

What you see: Every page shows Installation locked with the buttons Try to reconnect and Use backup key instead.

Cause: sslbrain Cloud has seen another machine report as the same installation, usually a copy of the virtual machine. Or the appliance has been restored from a backup. The vault is locked.

How to fix it:

  1. If a copy of the appliance is running, for example a clone in the hypervisor, shut it down.

  2. Click Use backup key instead.

  3. Enter the 12 backup words in Backup key, separated by spaces, and click Unlock.

The appliance shows Overview with a short confirmation in Danish that the vault is unlocked. Wrong words give a message in Danish saying the emergency key is invalid.

The installation has been retired

Copy link to the section “The installation has been retired”

What you see: This installation has been retired and “sslbrain Cloud no longer serves this appliance. …”

Cause: The licence has moved to another appliance.

How to fix it: Use the appliance that holds the licence now. If you need data from this one, open it with Use backup key instead. See Move or restore the appliance.

The appliance is awaiting confirmation

Copy link to the section “The appliance is awaiting confirmation”

What you see: The Awaiting confirmation page with Request ID, Expires and Last checked.

Cause: Someone clicked Try to reconnect on the Installation locked page. The appliance is waiting for a decision in sslbrain Cloud. The request expires after 7 days.

How to fix it: Click Back to lockdown and then Use backup key instead. Unlock with the 12 backup words. If you did not ask to reconnect yourself, contact FairSSL at info@fairssl.dk.

sslbrain Cloud cannot be reached

Copy link to the section “sslbrain Cloud cannot be reached”

What you see:

  • Cloud connection shows Not connected under Appliance and licence › Overview.
  • The login page: “Cloud authentication is currently unavailable. Try again or use emergency access.”
  • Updates: “The update check could not reach sslbrain Cloud. Check the cloud connection.”
  • Actions on Overview, after 48 hours: Kan ikke kontrollere for opdateringer.

Cause: A firewall, a proxy or DNS is stopping outbound HTTPS (443) to cloud.sslbrain.com, acme.sslbrain.com and registry.sslbrain.com.

How to fix it: Choose 2 Test the connection to sslbrain Cloud in the console menu.

  • NAME DOES NOT RESOLVE: correct the DNS servers under 3 Configure the network, see Console menu.
  • NO ANSWER: usually a firewall. Open outbound 443 to the three names.

If the appliance runs in Docker, test from the host:

Terminal window
curl -sS -o /dev/null -w '%{http_code}\n' https://cloud.sslbrain.com/api/v1/health

Meanwhile the certificates on your servers work until they expire. Login with a local password works, and so does login for a Cloud user who has logged in with a password before, see Users and sign-in. Alerts through E-mail (SMTP) and Webhook work, see Keep an eye on your certificates. Certificates ordered through sslbrain Cloud wait until the connection is back.

A service agent does not check in

Copy link to the section “A service agent does not check in”

What you see: “The agent on … is offline” under Monitoring › Alerts, or “The agent has not checked in for over a day.” on the server’s page. After 48 hours also “Sidste check-in for … timer siden” under Actions and the Agent stale alert rule.

Cause: The service is stopped, the server cannot reach the appliance’s address and port, or the appliance has a different address.

How to fix it on a Linux server: see the status and log under Log files, and restart with sudo systemctl restart sslbrain-agent.service.

On a Windows server, in PowerShell as administrator:

Terminal window
Get-Service sslbrainagent
Test-NetConnection -ComputerName <appliance-address> -Port 443
Get-Content "C:\ProgramData\sslbrain\logs\agent-$(Get-Date -Format yyyy-MM-dd).log" -Tail 50
Restart-Service sslbrainagent
  • The service is stopped: start it with Restart-Service sslbrainagent. If it stops again, read the log, see Windows servers.
  • TcpTestSucceeded is False: open outbound HTTPS from the server to the appliance. If you chose an Ekstern HTTPS-port other than 443 under Network and DNS › Network, test that one.
  • The server is outside your network: let the agent connect via sslbrain Cloud, see Servers outside your network.
  • The appliance has a different address or port: give the agents the current address, see How the agent reaches the appliance.
  • The server’s page says “The appliance was restored from a backup. …”: the agent gets work again once it has answered the appliance challenge, see Save a backup and restore from it.

A server without an agent cannot be reached

Copy link to the section “A server without an agent cannot be reached”

What you see: Status Unreachable or Auth failed under Servers, ”… is not responding” under Monitoring › Alerts, or the Connection lost alert rule after 2 hours.

Cause: The appliance connects to the device itself over SSH or the device’s API. Unreachable: the device does not answer on the port. Auth failed: the device rejects the credentials.

How to fix it: Open the server under Servers and click Test connection.

  • Unreachable: check that the device is running and that the appliance can reach it on port 22 for SSH or the device’s HTTPS port for API.
  • Auth failed: correct the credentials under Credentials, see Devices without an agent.

Domain validation fails

Copy link to the section “Domain validation fails”

Cause: The CA looks up a TXT record under _acme-challenge.<name> in public DNS. sslbrain creates it through the CNAME delegation to your Auto-DNS name or with a DNS API credential. If neither exists for the name, the certificate is not ordered.

What you see, and how to fix it:

  • “The CA could not find the DCV record in DNS. …”: check the CNAME delegation in public DNS, see below.
  • ”… the appliance has no DNS access to the zone. Create a CNAME from … to …”: create the CNAME the message names, see CNAME delegation.
  • ”… no DNS API credential covers the name. …”: create a CNAME delegation or a DNS API credential for the zone, see DNS API.
  • “The DNS API credential could not create the DCV record for …”: click Test access on the credential. Correct the key or its permissions at the DNS provider.
  • “The CA is not accepting more orders for these names right now (rate limit). …”: wait and try again.
  • “The appliance is not connected to sslbrain Cloud. …”: see sslbrain Cloud cannot be reached.

Check the CNAME delegation against a public DNS server:

Terminal window
dig @1.1.1.1 +short CNAME _acme-challenge.<domain>
Terminal window
Resolve-DnsName -Server 1.1.1.1 -Type CNAME _acme-challenge.<domain>

The answer must be the Auto-DNS name under Domain validation › CNAME delegation (Auto-DNS). The CA cannot see a record that exists only in your internal DNS.

A certificate is not renewed

Copy link to the section “A certificate is not renewed”

What you see: “Expires in … days” under Actions, the Renewal failed alert rule, or the source shows Error under Sources. sslbrain renews at the latest when 7 days are left, see First certificate on a server.

Cause and fix:

  • Domain validation fails: see Domain validation fails.
  • The appliance cannot reach sslbrain Cloud: see sslbrain Cloud cannot be reached.
  • The run shows “Sprunget over: mangler licens…”: the licence does not cover the servers, see The licence has expired or is too small.
  • The source shows “Queued, expected at …”: the account has used its orders for the day on sslbrain’s CA accounts. The order goes out by itself at the time shown, and the appliance collects the certificate as soon as it is issued. You do not need to do anything. If it says “Queued, issuance is paused for this account”, contact FairSSL support.
  • The certificate has no rule: create one, see First certificate on a server. Certificates you uploaded yourself are not renewed by sslbrain.
  • The certificate was renewed but not deployed: see Deployment to the server fails.

Deployment to the server fails

Copy link to the section “Deployment to the server fails”

What you see: “Failed deployment: …” under Actions, “Deploy failed on …” under Monitoring › Alerts, or the Deployment failed alert rule.

Cause: The run’s output says why. Often the agent is not checking in, the server cannot be reached, or the account on the server lacks permissions.

How to fix it:

  1. Open Deployment › Runs, choose Failing now, and open the run.

  2. Fix the cause. If the agent is not checking in, see A service agent does not check in. If the server cannot be reached, see A server without an agent cannot be reached.

  3. Click Run again. This needs the Operator role or higher.

If a renewed certificate is not deployed by itself, check that the rule is active and that Auto-deploy on certificate renewal is on. If the rule has a maintenance window, the certificate is deployed only within it. See First certificate on a server.

Login fails

Copy link to the section “Login fails”
  • “E-mail eller adgangskode er forkert.”: wrong e-mail or password. A Cloud account created with GitHub, Google or Microsoft has no Cloud password. Use Log in with sslbrain Cloud.
  • A Danish message about too many login attempts: more than 30 failed attempts. Wait the number of seconds the message gives.
  • “Cloud authentication failed. Please try again.”: try again.
  • “Cloud authentication is currently unavailable. …”: see sslbrain Cloud cannot be reached.
  • “You do not have access to this installation.”: the Cloud account is neither owner, administrator nor a member of this appliance. Give the person access under Team in sslbrain Cloud, see sslbrain Cloud.
  • “The licence on this appliance does not allow another login. …”: all the licence’s logins are in use, see Users and sign-in.
  • “Your session has expired. Please log in again.”: a session lasts 120 minutes. Log in again.

If nobody can get in, click Lost access? Use backup words on the login page and use the 12 backup words. Then give a user a local password, so there is a way in without sslbrain Cloud, see Users and sign-in.

The update fails

Copy link to the section “The update fails”

What you see: Update log under Maintenance and support › Updates shows “Failed: …” or “Rolled back: …”. The appliance keeps running the version it had.

Reason in the log, and how to fix it:

  • “there was not enough free disk to pull the new version …”: the update needs room for the new version (at least 4 GB) plus 2 GB, see The disk is filling up.
  • “the new version could not be downloaded”: the appliance cannot reach registry.sslbrain.com, see sslbrain Cloud cannot be reached.
  • “the signature could not be verified”: do not try again. Send a support bundle to FairSSL.
  • “the new version could not start” or “the new version did not respond correctly after starting”: read the controller’s log in the console menu under 4 View logs and then 2 The controller: updates, restarts, signature checks. Send a support bundle to FairSSL.
  • “a docker-compose override on the host pins a different image”: remove the image line from the override file on the host and update again.

If the page says “This release is not signed yet and cannot be installed.”, wait and click Check now later. See Keep sslbrain up to date.

The licence has expired or is too small

Copy link to the section “The licence has expired or is too small”

What you see: A Danish item under Actions saying the licence expires soon or has expired, servers marked Deactivated under Servers, or a new rule refused with “The licence includes no more deploy rules. …”

Cause: An expired licence falls back to Free, which covers 5 servers and 10 rules. The licence covers the oldest servers. On the rest, certificates are neither renewed nor deployed.

How to fix it: Renew or upgrade the licence under Licences and units in sslbrain Cloud, see sslbrain Cloud. Or delete servers you no longer use, and the next servers in line get a licence.

During first-time setup:

  • “This account has no licence free right now.”: buy a licence, or release the one another appliance holds, see Move or restore the appliance.
  • “A free license already exists on this IP address.”: there can be only one Free licence per IP address.

The disk is filling up

Copy link to the section “The disk is filling up”

What you see: A Danish item about low disk space under Actions at 80 %, and one about critically low disk space at 90 %. At 90 %, backups and updates that would fill the disk are refused. Certificate renewal carries on.

Cause: Backups, the appliance’s versions and log files share the same disk.

How to fix it:

  1. Download the backups you want to keep and delete old backups under System › Backup, see Save a backup and restore from it.

  2. Choose 7 Free disk space in the console menu. It removes unused images, including the version of the appliance that ran before the current one.

  3. If that is not enough, shut down the virtual machine, make the virtual disk larger in the hypervisor, and start the machine. Then choose 9 Danger zone and 5 Claim new space from the virtual disk. See Console menu.

If the appliance runs in Docker, free up space on the host.

Send a support bundle to FairSSL

Copy link to the section “Send a support bundle to FairSSL”

Under Maintenance and support › Support, on the Support bundle card, which only administrators see:

  • Send to sslbrain Cloud sends the bundle to FairSSL once you have confirmed. This needs a connection to sslbrain Cloud.
  • Download support bundle downloads the file sslbrain-debug-<date>-<time>.json. Send it to info@fairssl.dk.

Passwords, tokens, API keys and private keys are removed from the bundle. Hostnames and IP addresses stay in it. What the bundle contains: Support and diagnostics.