Step 7 of 8

7. Choose where certificates come from

A certificate profile decides where a certificate comes from. Use the Gratis Auto profile for your first certificate. The appliance has created it already, and you choose it in the rule in step 8.

Profiles and sources

Profiles are under Setup › Certificate issuance › Profiles. A profile tries its sources from the top. If the first cannot deliver, the next is tried.

Gratis Auto, labelled Starter profile: Let’s Encrypt, then Google Trust Services, via sslbrain Cloud. Created on the appliance when the licence is activated.
Default, labelled From sslbrain Cloud: Let’s Encrypt, then Google Trust Services. The appliance’s own certificate uses it (step 3).
FairSSL ACME med gratis backup, labelled From sslbrain Cloud: FairSSL, then Let’s Encrypt and Google Trust Services (FairSSL).

A profile labelled From sslbrain Cloud is changed in sslbrain Cloud and cannot be edited or deleted on the appliance.

Create a profile

Operators and administrators can create and edit profiles and sources.

Open Profiles and click Create certificate profile.
Give the profile a Name, for example Web and wildcard.
Click Add under Certificate sources next to each source the profile should use. Move them with the arrows. The order is the order they are tried in.
Choose Priority list failover under Choosing between sources.
Choose the Default key type. It is used by certificates that do not choose a key type themselves.
Click Create profile.

Free certificates with Gratis Auto

Gratis Auto gives free DV certificates and costs no units. The default key is ECDSA P-384.

The appliance creates the key and the CSR. During issuance the private key stays on the appliance, and only the CSR is sent on. The key goes to a server only when a rule installs the certificate (private key export). Domain validation uses your CNAME delegation or DNS API credential from step 6.

If you rename or delete the profile, sslbrain does not create it again.

Certificates from FairSSL

The rule orders FairSSL certificates through the profile. Nothing has to be ordered by hand in sslbrain Cloud.

Ask FairSSL to link your sslbrain Cloud account to your FairSSL account.
sslbrain Cloud creates the profile FairSSL ACME med gratis backup, and it arrives on the appliance by itself.
Choose the profile in the rule in step 8.

DigiCert certificates via FairSSL need the record _dnsauth.<domain> (CNAME delegation).

Products that cost units are paid for with units you buy in sslbrain Cloud under Licenser og units (units). The sslbrain Cloud certificate order source shows under Products which products the account can get.

Sources and order

Sources are under Sources › Sources. New sources are created with Add source:

sslbrain Cloud certificate order: a signed certificate order through sslbrain Cloud. The private key stays on the appliance.
ACME directly from the appliance: the appliance talks ACME to a CA itself, on your own ACME account. Ready to use are Let’s Encrypt, Google Trust Services, ZeroSSL, Sectigo, GlobalSign Atlas, SSL.com, DigiCert Trust Lifecycle and FairSSL ACME, and you can enter the address of another ACME server. If the CA requires EAB (External Account Binding), you enter the two EAB values from the CA.
Windows CA: certificates from your own AD CS (Windows CA).
MitID: VOCES, FOCES and MOCES certificates from MitID Erhverv. Needs the MitID module.
Manual certificate upload: certificates you upload yourselves (upload).

Certificates a service agent finds in the Windows certificate store on a server can be imported into sslbrain (Certificates on the servers).

The profile skips a source that is in error, cannot issue the certificate’s key type, or has no enabled product that covers the names. A temporary error is retried once on the same source. Every renewal starts from the top of the list.

An owner or administrator can stop a source from sslbrain Cloud on this appliance with Block on this appliance. Only administrators can delete a source.

Lifetime: the Let’s Encrypt profile on the source

A Let’s Encrypt source chooses the profile Let’s Encrypt issues with, and with it the certificate’s lifetime. The choice belongs to the source: every certificate profile that uses the source gets it. For both a long and a short lifetime, create two sources with a profile each: on the appliance on every paid licence, and in sslbrain Cloud as your own ACME source with Let’s Encrypt’s address, also on every paid licence (Add your own ACME account (EAB), where Basic can only choose Let’s Encrypt).

The list is the one Let’s Encrypt itself advertises (Let’s Encrypt’s profiles). When Let’s Encrypt adds a profile, it appears in the list without an sslbrain update. On 04-10-2026 it was:

Profile	Lifetime	Names per certificate	Common Name
classic (default)	90 days, 64 days from 10-02-2027	100	Yes
tlsserver	45 days	25	No
shortlived	about 6 days (160 hours)	25	No

A certificate with more than 25 names is issued with classic. With tlsserver and shortlived a domain validation is reused for at most 7 hours, so the names are validated again at almost every renewal.

On the appliance: open the source under Sources › Sources, click Edit all fields, and choose ACME profile (certificate lifetime). The field is on Certificate order through sslbrain Cloud, where it applies when sslbrain Cloud issues from Let’s Encrypt, and on Direct ACME from the appliance with a Let’s Encrypt account.
In sslbrain Cloud: open Certificate sources, choose the profile under Let’s Encrypt, and click Save profile. It applies to the Cloud profiles, the profiles the appliance takes from sslbrain Cloud, and ACME clients through acme.sslbrain.com.

Licence. Choosing a profile needs Basic, Professional or Enterprise. Free issues with classic. When the licence expires or goes down to Free, the choice stays saved, but the source issues with classic until the licence includes it again. Certificates keep being issued and renewed, and the source shows why the profile is not used.

Renewal. sslbrain renews when Let’s Encrypt’s renewal window (ARI) says so, and otherwise two thirds into the certificate’s lifetime, half way for a certificate under 11 days: a 90-day certificate about 30 days before it expires, a 45-day one 15 days before, and a shortlived one about 3 days before, as Let’s Encrypt’s own renewal window for it says. A certificate with its own renewal margin follows it; a margin at least as long as the lifetime becomes half the lifetime.

shortlived needs full automation. The certificate is renewed after about 3 days, and domain validation has to succeed every time. Use shortlived only where the rule installs the certificate itself and DNS validation runs hands-off (step 6). If a renewal fails, there are about 3 days to fix it.

Failover and changes at Let’s Encrypt. The profile applies to Let’s Encrypt only. When an order moves on to Google Trust Services, Google issues with its own default lifetime, and the order records it. If Let’s Encrypt stops offering the chosen profile, certificates are issued with classic, and the source shows it.

Internal certificates from Windows CA

The Windows CA source gets certificates from your own Active Directory Certificate Services. It needs the Enterprise licence with the Windows CA add-on, and the Windows CA module. The setup is in Internal certificates from Windows CA.

Certificates you upload yourselves

A certificate from another CA is uploaded under Certificates with Upload certificate.

Formats: PEM, CRT, CER, DER, PFX, P12 and JKS. P7B is not accepted. At most 5 MB per file.
Without a private key, the certificate is used only for monitoring and expiry dates. Deployment needs the matching key.
sslbrain does not renew an uploaded certificate. Upload the next edition with Upload new version on the certificate.

An uploaded certificate that does not belong to an existing certificate is put on the profile Manual upload. Uploading from discovery is in step 4.

If it fails

Gratis Auto is missing: the profile is created when the licence is activated, and only when the appliance is connected to sslbrain Cloud. Check the connection.
The profile shows No source can issue right now: open the source from the link and correct the error. See also Renewal fails.
Issuance stops at domain validation: see Validation fails.