Built for real infrastructure

sslbrain manages certificates across Windows and Linux servers, supports multiple certificate authorities, and automates the entire lifecycle.

Shorter lifetimes, more renewals

Certificate lifetimes are getting shorter, and will get shorter again. The CA/Browser Forum has binding deadlines that step the maximum lifetime down in three phases through 2029.

2026, active

200 days

Maximum lifetime and DCV reuse since March 2026.

2027

100 days

Next step. Lifetime and DCV reuse are halved.

2029

47 days

Final target. DCV reuse drops to 10 days, so domain validation runs every renewal.

With 50 servers and 47-day certificates that becomes up to 600 renewals per year if each certificate is renewed at one third of its lifetime as best practice. sslbrain uses a central scheduler that scales automatically regardless of how short lifetimes become.

Switch CA without touching a server

sslbrain communicates with the CAs and installs the certificates on your servers through signed agents. If a CA changes its API, standards, or pricing, we update the connection and your servers notice nothing.

You can switch between Let's Encrypt, Google Trust Services, DigiCert, Sectigo and GlobalSign without changing configuration on a single server. sslbrain absorbs the complexity.

Certificate Sources

We support any ACME-based CA.

Let's Encrypt (ACME)
Google Trust Services (ACME)
DigiCert
Sectigo
GlobalSign Atlas
Internal CA
Custom CA

Endpoints

Deploy certificates to any server platform.

Microsoft IIS (Windows Server)
Apache HTTP Server
Nginx
HAProxy
Tomcat / Java Keystore
FortiGate / FortiMail
Citrix NetScaler
Microsoft Exchange
Any endpoint via custom agents

Protocol Support

Industry-standard protocols for validation and deployment.

ACME (RFC 8555)
DNS-01 validation (auto-DNS)
HTTP-01 validation
SSH-based deployment
REST API integration

Lifecycle Management

Automate the entire certificate lifecycle.

Automatic DNS-based validation
Automatic certificate discovery
Expiry monitoring & alerts
Automated renewal
Multi-domain (SAN) certificates
Wildcard certificates
Certificate revocation

Security

Enterprise-grade security built in.

On-premises. Your data stays on your network
Data encrypted by rotating online vault key
Code running on your network is visible and inspectable
Every catalogue agent security inspected and signed by FairSSL
Own key pair per service agent, messages encrypted with AES-256-GCM
Scripts executed via stdin, never written to disk
Role-based access control
Audit logging

Operations

Simple to deploy and operate.

One appliance (OVA/KVM or Docker)
SQLite database (zero config)
Setup wizard (3-minute onboarding)
Web-based management UI
Agent-based architecture
Update agents and sslbrain via sslbrain Cloud
Fixed IPs for firewall whitelisting

Explore the features in depth

Each core capability explained the way it works in practice.

Automatic renewal

sslbrain renews your certificates in the CA's recommended window or at 75% of lifetime and installs them where they are used. Shorter lifetimes stop being your problem.

Network discovery

Scan your IP ranges and find every TLS certificate in the environment, including the ones nobody documented. Visibility before automation.

Deployment agents

Signed agents install certificates on Windows, Linux, network appliances, and cloud platforms. The catalog lists 74 integrations. Push or pull, your choice.

Least privilege in practice

The pull agent on the server never receives SSH keys or sudo from the appliance. It only runs signed tasks, and you decide how much privilege it holds.

ACME and Auto-DNS

sslbrain speaks ACME to the CAs and answers domain validation automatically. Your servers never run their own ACME clients.

On-prem appliance

sslbrain runs as a virtual machine (OVA or KVM) or in Docker inside your network. Private keys and credentials stay on the appliance.

Source-available code

Every line of code can be inspected, and every agent is signed with a YubiKey. Trust in a security product should be verifiable.

74 integrations

Integrations

sslbrain installs certificates on Windows and Linux servers, load balancers, firewalls, storage and cloud services. Each integration below leads to its own page on how the certificate gets there. In the overview you can search and filter by operating system and type.

Control, keys and data on-premise

EU company & cloud

Certificate authorities

Firewall and VPN

Load balancer

Cloud service

Storage and virtualisation

Apps and databases

Mail server

Web server

Basics

Identity and remote access

See all integrations

Agent-based architecture

sslbrain uses YAML-defined agents to handle certificate deployment. Each agent is a set of platform-specific scripts that run on the endpoint. This approach means:

Support for any platform without code changes

Ready-made FairSSL agents for common platforms

Custom agents for your specific needs

Full audit trail of every deployment step

Windows Service Agent (.NET 9, pull-based)

No inbound ports required. Pulls signed tasks over HTTPS. The install code is used only for the first enrolment; after that the agent has its own key pair, and every message is signed and encrypted with AES-256-GCM.

Secure agent execution

Scripts are executed via stdin piping directly to the interpreter. No script files are written to disk. Secrets are passed via environment variables, never as command-line arguments.

Stdin execution: no scripts written to disk

Secrets via environment variables, never CLI arguments

Own key pair per service agent, messages encrypted with AES-256-GCM

Encrypted task packages using ECIES (ECDH + AES-256-GCM)

Read-only container, tmpfs-backed temporary storage

no-new-privileges, restricted PATH

Security you can verify

sslbrain is designed to be transparent. All code is visible and inspectable.

YubiKey-signed agents

Every agent in the catalogue is written, reviewed and signed by us. A suggestion from a user becomes an agent only after we have reviewed it, locked the code and released it under FairSSL's signature. All scripts are visible on GitHub and can be inspected.

ECDSA P-384 signature per agent package

Physical YubiKey touch per signing

Category (read/write) baked into signature

Date baked into signature (no backdating)

Developer Code review YubiKey signing Cloud Your sslbrain Server

You decide what runs

Every server has a ScriptPolicy that decides what it accepts. By default the agents run only agents and scripts signed with FairSSL's hardware key. Your own agents run only where you switch them on. The policy is set on the server and can be locked via Group Policy.

FairSSL agents: Written, signed, maintained and tested by FairSSL.

Suggestions from users: Reviewed, locked and released by FairSSL as FairSSL agents under our signature.

Custom agents: Written by you and signed by your appliance. They run only on a server where you have switched that on. Nothing runs unsigned.

TrustSignedBefore: Set a date. The agent rejects anything signed after that date until you approve. Full control over updates.

Least privilege by default

The recommended pull agent never receives SSH keys or sudo from the appliance and only executes signature-verified tasks. How much privilege the service holds locally is your call: root for simplicity, or a scoped service user with access to one service's certificate files and one reload command.

Read about least privilege in practice

Your data stays on the appliance

Cloud cannot fetch or see your data

Stolen copy is useless

View the full security architecture

NIS2 documentation

NIS2 requires documented, monitored, and auditable security processes. A cron job is not a documented process. sslbrain provides the structure and evidence that NIS2 demands for certificate management.

Audit log with CSV and JSON export

Source-available code for security review

Documented process, not a cron job

Ready to automate your certificates?

Get started in under 5 minutes with the Free plan.

Get early access Contact us

View the full security architecture

sslbrain is built by FairSSL A/S, a Danish company with 16 years of experience in the SSL certificate industry.