Credentials do not belong in someone else’s cloud
Certificate automation needs admin access to firewalls, load balancers, and servers. Put those credentials into a SaaS product and its vendor effectively holds access to your infrastructure. sslbrain runs as an appliance inside your own network, so SSH keys and API tokens stay behind your firewall.
Outbound traffic only
The appliance needs outbound HTTPS to cloud.sslbrain.com (licensing and certificate issuance), acme.sslbrain.com (sslbrain Cloud’s ACME server) and registry.sslbrain.com, where the appliance fetches its signed image on update. No inbound connections from the internet are required, and we have no remote access to your installation. The fixed IP addresses are documented so your firewall can be locked down accordingly: the sslbrain services have one address today, 81.27.110.46, and we expect up to three. Every port is listed in the manual.
Encrypted vault
Private keys and credentials are stored in an encrypted vault on the appliance. The master key never leaves the appliance; the cloud service holds only a key encryption key, which cannot decrypt your data on its own. A stolen copy of the database is useless. The full design is described on the architecture page.