Free for up to 5 servers
All your certificates, on-premises
Your sslbrain On-Premise discovers, installs and renews certificates on your servers, firewalls and load balancers, inside your own network.
Private keys are generated and kept encrypted on your side, out of reach of sslbrain Cloud (EU). FairSSL has no access to your network. The source code can be inspected. Free certificates from Let's Encrypt and Google.
No credit card required
Built by FairSSL, a Danish company that has supplied certificates to municipalities, regions, hospitals, and enterprises for 16 years.Certificates for the equipment you already run
With sslbrain, certificates are obtained from the CA you choose and installed on servers, network equipment and cloud services. Click the wheel to see every integration and how the certificate gets there.
80 systems we install on
See all
Create free account
Free costs nothing and needs no credit card. You choose your edition once the account exists.
Everything you need for certificate management
One appliance. All your certificates. Fully automated.
Discover
Scan your network to find every certificate. Know what you have, where it is, and when it expires.
Automate
Issue and renew certificates automatically. No manual steps. No expired certificates. No outages.
Deploy
Push certificates to IIS, Apache, Nginx, and more. Integrations handle the last mile on every platform.
Some of our supported CAs
Windows CA 
Your certificates, your servers, your network
Certificate automation requires admin credentials to your firewalls, load balancers, and servers. Those credentials cannot exist in someone else's cloud. The appliance runs inside your network.
Credentials stay local
SSH keys and API tokens stay on the appliance. DNS-API credentials can stay on your network. The calls go directly or through our proxy with TLS all the way to the DNS provider, so Cloud cannot read them. If you want to use ACME clients directly against Cloud, you can choose to store them in Cloud.
Encrypted vault
XChaCha20-Poly1305 encryption. The decryption key exists only in memory, never on disk.
Fixed IP addresses
Only sslbrain needs outbound access to Cloud. Minimal firewall configuration.
One appliance for everything
IIS, Nginx, Apache, Exchange, FortiGate, and NetScaler from the same dashboard.
How sslbrain fits together
The sslbrain appliance runs in your network and keeps track of the certificates. This is how the parts fit together. Tap the drawing to see it large.
- Your network: sslbrain On-Premise runs here and generates the private keys, and sslbrain Cloud (EU) never sees them. On-Premise talks only to Cloud, outbound on port 443.
- Domain validation: a CNAME to your.autodns.sslbrain.net, access to your DNS provider’s API, or a dns-persist-01 TXT record.
- CA: your choice of Let’s Encrypt, DigiCert, Google Public CA, Sectigo or GlobalSign, or your own Windows Certificate Services. Cloud talks to the CA and to DNS.
- Service agent: Windows and Linux servers fetch them from On-Premise on port 443.
- Push installation: devices without a service agent get their certificates from On-Premise, for example FortiGate, F5, NetScaler, Palo Alto and other equipment.
- Remote site: a service agent in a DMZ or at a remote site connects via sslbrain Cloud (EU), outbound on port 443 and E2E, with no connection to your network.
How it works
Three steps to automated certificate management.
Install the appliance
Download the appliance for VMware, Proxmox/KVM or Docker and start it in your own network. In the setup wizard you link it to your sslbrain Cloud (EU) account, choose a licence and store the 12 backup words.
- No inbound ports open from the internet
- The setup wizard in the browser does the rest
Choose a platform
- VMware vSphere, ESXi, Workstation, Fusion OVA
- Proxmox and KVM Proxmox, KVM, libvirt qcow2
- Docker on your own Linux server installer
Virtual appliance: 2 vCPU, 4 GB RAM, 40 GB disk
Add servers
Windows and Linux servers get the service agent, which installs the certificate in the service that uses it. Network devices and cloud services get the certificate straight from the appliance over their API or SSH, with no service agent.
- The service agent fetches its own tasks over outbound HTTPS
- The Windows service agent can be rolled out with GPO, SCCM or Intune
With the service agent
Windows and Linux servers
- IIS
- Exchange
- ADFS
- RDP
- Apache
- Nginx
- Tomcat
- and more
Without a service agent, over API or SSH
Network devices and cloud services
- F5 BIG-IP
- FortiGate
- NetScaler
- Palo Alto
- Azure Key Vault
- AWS ACM
- and more
Automate your first certificate
Order a certificate for a domain. From then on sslbrain handles validation, issuance, installation and renewal. Validation runs over DNS, so the server does not have to be reachable from the internet.
- Free certificates from Let’s Encrypt and Google Trust Services
- DNS validation with AutoDNS (CNAME) or your DNS provider’s DNS-API
- Ordering from the CA, through sslbrain Cloud or from your Windows CA
- Validation over DNS, also for servers behind a firewall
- Installation by the service agent or directly on the device
- Renewal in good time before the certificate expires
Automate your certificates
Free is free for up to 5 servers. Create your account and install sslbrain.