How sslbrain Works
Architecture, security, and data flow.
sslbrain Cloud and your sslbrain
Two distinct systems. Your data stays with you.
cloud.sslbrain.com
Your sslbrain
sslbrain and your servers
Two deployment models. No inbound ports required on targets.
Push
sslbrain connects to your servers and deploys certificates directly.
Pull
The Windows Service Agent fetches tasks from sslbrain via mTLS-authenticated HTTPS.
This agent-based approach means sslbrain handles any platform with a certificate — Windows, Linux, macOS, or network appliances — through the same orchestration layer. No platform-specific licensing, no separate tools.
Certificate sources
We support any ACME-based CA including:
Free CAs
Paid CAs
Own CA
ACME Cloud certificate flow
Your sslbrain sends the request. ACME Cloud handles the rest.
Vault and encryption
A database copy is useless without access to your Cloud Vault.
3-layer encrypted vault
All local data including private keys and login credentials is encrypted with XChaCha20-Poly1305 and a 256-bit key via libsodium. Encryption keys are wrapped on the appliance with the master key. The master key never leaves the appliance. sslbrain Cloud Vault (OpenBao, EU-hosted) holds only the KEK that wraps the master key on disk; the KEK lives only in memory at boot and is discarded after unwrap.
Every time sslbrain starts, it contacts sslbrain Cloud with a rotating API key and rotating encryption key. A copy of the database is therefore useless without access to your Cloud Vault.
By default, Cloud Vault blocks access attempts from a new IP or with an old API token. You can allow it through your account or settings.
This effectively protects against data access by copying files or server images. The server must of course still be protected locally.
Agent execution and mTLS
Secure execution from orchestrator to server. No secrets in files, no scripts on disk.
Stdin execution
Scripts are piped directly to the interpreter via stdin. No temporary script files are written to disk. Secrets are passed as environment variables, not command-line arguments.
echo "$script" | bash -s echo "$script" | python3 - PowerShell.Create() mTLS and encrypted packages
The Windows Service Agent enrolls with an ECDSA P-384 client certificate at registration. sslbrain's internal CA issues the certificate. All communication uses mutual TLS authentication.
Agent signing
Every script that runs on your servers is signed. No exceptions.
YubiKey-signed agents
All scripts are signed by FairSSL with ECDSA P-384 via YubiKey. Per-file signatures. Community scripts are reviewed and signed by FairSSL. The Windows Service Agent only runs signed files.
ScriptPolicy + Group Policy
Every server has a ScriptPolicy defining what it accepts. Restrict to FairSSL-signed scripts only, allow community scripts, or allow everything including custom scripts. Lockable via Group Policy.
Supported platforms
From Windows to Linux to network appliances.
Windows
Linux
Network
Custom
Protocols
Standards-based from top to bottom.
Certificate issuance
Validation
Deployment
Scripting
Code transparency
Everything is inspectable. No black boxes.
sslbrain core
sslbrain is PHP source-available. You can read every line of code running on your server.
Agents and tools
Agents are YAML + scripts on GitHub. The Windows Service Agent is .NET and verifies signatures. sslbrain handles the ACME protocol against the CA so your servers never talk to a CA themselves.
Enterprise Security Guarantees
Three architectural commitments that set sslbrain apart.
No-Takeover Architecture
sslbrain cannot push code to your servers. Agents run locally on your infrastructure, initiated by your admin. There is no remote execution path from our cloud to your endpoints. This eliminates SolarWinds-type supply chain risk by design.
Audit-Ready Source
sslbrain is source-available. Your security team can read every Python, Bash, and PowerShell script before it runs on your servers. No blind trust in compiled binaries. Every agent action is inspectable, auditable, and verifiable.
Hardware-Rooted Trust
Every agent is signed with ECDSA P-384 using a YubiKey hardware security key. The private signing key never leaves the physical device. Signatures are verified on every execution. Tampered or unsigned scripts are rejected before they run.
Get started
Download sslbrain and manage your certificates in minutes.