Step 5 of 8 · Connection
How the service agent reaches the appliance
Copy link to the page “How the service agent reaches the appliance”Check the service agent connection and change the address for a server that needs its own route to the appliance.
What you need
Copy link to the section “What you need”- Administrator access to the appliance.
- A server with a service agent installed using an install code.
- The HTTPS address the server should use if it differs from the appliance address.
Change the connection for one server
Copy link to the section “Change the connection for one server”- Open the server under Servers › All servers.
- Open Settings for this agent under Technical › Service agent.
- Change Addresses in priority order (comma-separated, appliance for this appliance’s own address, cloud for sslbrain Cloud) if the server needs another address. For example, use
https://sslbrain.example.com,cloud. Leave fields empty to follow the defaults. - Save and wait for the next check-in.
Check that it works
Copy link to the section “Check that it works”In the Service agent panel, Configuration shows the same version number for sent and in use. Last answer shows Taken into use or Taken into use after a probe. Under Addresses in use, in use now marks the active address. Last reached shows Directly or Through Cloud.
Next step
Copy link to the section “Next step”Continue with Prove the domain is yours.
If it fails
Copy link to the section “If it fails”- Last answer shows Refused or Using its last working configuration → correct the address or port and check that the server can reach it.
- The list cannot be saved → use 1 to 8 different addresses with at least one direct destination. An HTTPS address must not contain a username, query or fragment.
- The server cannot reach any direct address → follow Servers outside your network.
- The check-in timestamp does not change → follow The service agent does not check in.
- The service agent was installed without a code → follow Service agents without an install code.
Directly to the appliance
Copy link to the section “Directly to the appliance”The service agent contacts the appliance over outbound HTTPS, usually port 443. Under Appliance › Network › Network, Agents connect to shows the address. It follows the appliance hostname and External HTTPS port. If the Docker installation uses port 8443, enter 8443 here.
If the hostname or port changes, service agents with an install code receive the address at their next contact. Keep the address they currently use, or the connection via sslbrain Cloud (EU), reachable until the change has been applied.
Via sslbrain Cloud (EU), E2E
Copy link to the section “Via sslbrain Cloud (EU), E2E”The service agent can also reach the appliance via sslbrain Cloud (EU), E2E. Both connect outbound and messages are encrypted between the service agent and the appliance. The Cloud connection requires Allow agent communication through Cloud under Appliance › Users and login › Login and sessions. See setup and licensing.
Addresses are used in order
Copy link to the section “Addresses are used in order”The Addresses card under Servers › Add server › Settings shows the appliance address and sslbrain Cloud as fallback when allowed. Change the address under network settings; change an individual server’s list on its server page.
In a server’s own list, appliance means the current appliance address, while an explicit HTTPS address stays unchanged if the hostname changes. The entry cloud means via sslbrain Cloud. Without cloud, the service agent does not use this connection until an administrator selects Turn Cloud on again for this agent.
How often the service agent checks in
Copy link to the section “How often the service agent checks in”Under Servers › Add server › Settings, Check-in, retries and timeouts shows the intervals. The service agent receives changes at its next contact.
| Field | Default in seconds |
|---|---|
| Idle check-in interval (seconds) | 900 |
| Normal check-in interval (seconds) | 300 |
| Fast check-in interval (seconds) | 30 |
| Edit check-in interval (seconds) | 30 |
| Quick follow-up after work (seconds) | 5 |
Check-in intervals can be set from 1 to 86400 seconds; the appliance adjusts them to what the service agent version supports. Default jitter is 20%.
When an address does not respond
Copy link to the section “When an address does not respond”By default, the service agent waits 60 seconds after a failure and doubles the delay up to 3600 seconds. After 3 consecutive failures, it tries the next address. It retries the first after 1800 seconds.
Default connect, request and probe timeouts are 10, 60 and 120 seconds. Connect timeout must be less than request timeout, which must not exceed probe timeout. The card shows the permitted ranges.
The appliance signing key
Copy link to the section “The appliance signing key”The The appliance agent key card shows the key fingerprint. Only the owner can use Change the signing key. Unused install codes then stop working. Take a backup after the change; a backup with the other key cannot serve the service agents.