Step 1 of 8
1. Install sslbrain
Copy link to the page “1. Install sslbrain”sslbrain runs as an appliance on your own network. Once it answers in the browser, everything else is set up from there.
Before you start
Copy link to the section “Before you start”- An sslbrain Cloud account that has accepted the licensing terms and the data processing agreement.
- For the virtual appliance: 2 vCPU, 4 GB RAM and a 40 GB disk, thin provisioned.
- For Docker: a Linux server with 4 GB RAM and 20 GB of free disk space.
Choose a platform
Copy link to the section “Choose a platform”- VMware vSphere, ESXi, Workstation or Fusion: the OVA file. See VMware.
- Proxmox, KVM or libvirt: the qcow2 disk image. See Proxmox and KVM.
- Your own Linux server with Docker: the installation script. See Linux with Docker.
Hyper-V is not supported. The virtual appliance comes with a console menu, Ubuntu security updates and a ready-made firewall. With Docker, you keep the operating system up to date yourself.
First boot
Copy link to the section “First boot”On first boot, the virtual appliance downloads the newest sslbrain version by itself. This takes a few minutes.
-
Wait until the console shows
Open https://<ip> in a browser to use it. -
Open the address in your browser.
http://<ip>redirects to HTTPS. -
The browser warns about the certificate, because the appliance has created a self-signed certificate. To check that it is your appliance, compare the fingerprint with the SHA-256 fingerprint under item 1 in the console menu.
-
The setup wizard opens with the Log in with sslbrain Cloud button.
Continue with 2. First-time setup.
Internal DNS servers
Copy link to the section “Internal DNS servers”If sslbrain needs to look up internal names, such as servers in Active Directory, enter your internal DNS servers once setup is complete.
-
Open Network and DNS › DNS servers. The page requires the administrator role.
-
Enter your internal DNS servers under DNS-server IP-adresser, separated by commas. These are usually your domain controllers.
-
Under Søgedomæner, enter the domains that short names are looked up in.
-
Click Gem. Look up an internal name under Test DNS-opslag to check that it works.
The appliance asks your DNS servers first, then the servers it already had, and finally 1.1.1.1. Aktiv konfiguration shows what it is using now.
If it fails
Copy link to the section “If it fails”- The console shows “NO NETWORK ADDRESS”: the appliance has not received an address via DHCP. Set a static address with item 3 in the console menu. The appliance carries on by itself.
- The console shows “The IP address from the deploy wizard was refused”: the appliance has stayed on DHCP. The reason is in the message. Set the address with item 3 in the console menu.
- The software cannot be downloaded: the appliance tries again every 30 seconds. Item 2 in the console menu shows whether the name cannot be resolved (DNS) or does not answer (firewall). See Network and firewall and No connection to sslbrain Cloud.
- The signature check fails: the appliance does not start the software and tries again every 5 minutes. Item 4 and then item 3 in the console menu show the log file from first boot. Send it to FairSSL (Support and diagnostics).
- The browser cannot reach the appliance: see the status and address under item 1 in the console menu.
Network and firewall
Copy link to the section “Network and firewall”The appliance only needs outbound connections to the internet. Use the names in the firewall if it supports them, because the addresses behind them can change.
| From | To | Port | Used for |
|---|---|---|---|
| The appliance | cloud.sslbrain.com | 443 | Activation, licence and sslbrain Cloud |
| The appliance | acme.sslbrain.com | 443 | Certificate issuance |
| The appliance | registry.sslbrain.com | 443 | The appliance’s software and updates |
| The virtual appliance | archive.ubuntu.com, security.ubuntu.com | 80 | Ubuntu security updates |
Without port 80 the appliance runs, but Ubuntu gets no security updates. Ubuntu restarts at 03:00 when an update requires it.
On your own network:
| From | To | Port |
|---|---|---|
| Browsers and service agents | The appliance | 443 on the virtual appliance, 8443 with Docker |
| The appliance | Devices without an agent, via SSH | 22 |
| The appliance | Devices managed via API | the device’s HTTPS port |
| The appliance | The DNS provider’s API, if you use a DNS API for domain validation | 443 |
Static IP address or DHCP
Copy link to the section “Static IP address or DHCP”The virtual appliance uses DHCP. A static address is entered during import: as OVF properties in VMware, or on a seed disk in Proxmox and KVM. The address is read once, at first boot. After that, you change the address with item 3 in the console menu (Console menu). Without DNS servers, the appliance uses 1.1.1.1 and 9.9.9.9.
The console menu
Copy link to the section “The console menu”The virtual machine’s console shows a menu in English instead of a login prompt. Every item is described under Console menu. A Docker installation has no console menu.
CPU and RAM are changed in the hypervisor. To enlarge the disk, grow the virtual disk while the machine is powered off, then choose items 9 and 5 in the console menu. Before the first boot, growing the disk is enough.