Step 5 of 8 · Linux

Linux servers

Connect a Linux server with the install code from the appliance.

What you need

An x86_64 or arm64 server with systemd, such as Ubuntu, Debian or Red Hat Enterprise Linux.
Root access or an account with sudo, plus administrator access to the appliance.

Install the service agent

Open Servers › Add server › With service agent and select Linux.
Copy the direct connection command. The code and address are filled in.
Paste the line into a terminal on the server and press Enter. Wait for installation to finish.

Check that it works

After a minute or two, the server appears under Servers › All servers. On the server page, Last check-in updates and discovered Nginx and Apache services appear under Certificates. Status Connected · Not automated is expected until you create an installation plan.

Next step

Continue with Prove the domain is yours.

If it fails

specify --code or --server → copy the full command from Servers › Add server › With service agent again.
does not match its checksum → run the command again; the downloaded file does not match the check.
The Linux command is missing → check the appliance connection to sslbrain Cloud (EU) and try again once the service agent has been downloaded.
no verified Linux agent package → check the appliance connection to sslbrain Cloud (EU) and try again once the service agent has been downloaded.
SSL certificate problem → give the appliance a certificate the server trusts, then copy the command again.
The server cannot reach the appliance directly → follow Servers outside your network.
You cannot run the command locally → install the service agent from the appliance.
The server is waiting for approval → compare the key as described below.
The server does not appear → read the log and follow The service agent does not check in.
A tool is missing → install bash 4.4 or later, openssl, tar, curl or wget, flock, timeout, base64, find, od and sed.
The server has no systemd → add --mode cron to the command.

The server is waiting for approval

A server with an install code is normally approved. If it looks like a reinstall, it appears under Servers waiting for approval on Servers › Add server › With service agent. Compare Agent key with the key in the service agent log, then click Approve if the machine is yours.

Log files

systemctl status sslbrain-agent.service
journalctl -u sslbrain-agent.service -n 50 --no-pager

With --mode cron, the log is at /var/lib/sslbrain/state/agent.log.

Installation options

agent.sh passes options on to install.sh.

Option	Meaning
`--code <code>`	The install code. With `--server`, it connects directly with sslbrain Cloud as fallback; without it, the connection goes via sslbrain Cloud
`--server <address>`	The appliance address for first contact. Without a code, the server waits for approval
`--cloud-deny`	The service agent never contacts sslbrain Cloud
`--profile deploy`	Default: runs as root, installs certificates and reloads services
`--profile scoped`	Writes to permitted certificate folders and reloads through a root-owned hook. Requires local configuration
`--profile inventory`	Finds and monitors certificates without installing
`--mode systemd\|timer\|cron`	How it runs. Default: `systemd`
`--code-file <file>`	Reads the code from a file, or from standard input with `-`

Either --code or --server is required. Reinstalling without --profile keeps the profile. The program is at /usr/local/lib/sslbrain/sslbrain-agent, settings at /etc/sslbrain/agent.conf and state at /var/lib/sslbrain/state.