Policy and audit
Copy link to the page “Policy and audit”Check what the appliance can do automatically and find the log of changes.
What you need
Copy link to the section “What you need”- An administrator login for the appliance to change automation settings.
View and change automation settings
Copy link to the section “View and change automation settings”- Open Appliance › Licence and status › Operation mode. Automation now shows what is enabled.
- Open Appliance › Maintenance › Updates and adjust the four switches for appliance updates, modules, integrations and automatic approval. See the switches.
Certificates renew regardless of the operation mode. In setup’s Operation and diagnostics, Auto enables all four parts. Manual leaves them off and approves the bundled integration versions in your name.
Check that it works
Copy link to the section “Check that it works”Return to Operation mode. Automation now shows the switch settings. Diagnostics sharing is controlled separately under Support and diagnostics.
If it fails
Copy link to the section “If it fails”- You cannot change anything on Operation mode → the page only shows status. Change the switches under Updates.
- The server rejects your own integration → check permission under Scripts on servers.
- Free rejects a domain → see the domain limit.
Scripts on servers
Copy link to the section “Scripts on servers”The service agent checks the signature before execution. The server’s script policy decides what it may run. The Allowed scripts setting under Appliance › Integrations › Approval is not sent to service agents.
The default value of 15 allows integrations from FairSSL and from others, but excludes your own integrations. The catalogue’s integrations are written, reviewed and signed by FairSSL.
Allow your own integrations with Allow own scripts from this appliance during installation or under Own scripts on the server’s page. The appliance adds trust in its key over WinRM or SSH. See Your own integrations.
For a manual Windows service agent installation, use ALLOW_CUSTOM_AGENTS_FROM=LOCAL and TRUSTEDKEYS_CUSTOM, see MSI properties. The service agent adds bit 16 itself without changing ScriptPolicy. A value from Group Policy takes precedence. Servers without a service agent have no script policy.
Automatic downloading and approval of integration versions are controlled under Appliance › Integrations › Automatic. See Keep integrations up to date. See also Servers sslbrain does not know.
The Free domain limit
Copy link to the section “The Free domain limit”A Free account allows 2 registrable domains across its appliances and at most 100 names per certificate. example.com, www.example.com and mail.example.com count as one domain. Basic, Professional and Enterprise have no licence limit on domains or names; CA limits still apply.
If the account holds certificates for more domains, they keep renewing. Only an additional domain is refused. When you order, sslbrain Cloud (EU) counts the account’s domains. There is no lock period, regardless of what Appliance › Licence and status › Domain lock shows.
Find changes and sign-ins
Copy link to the section “Find changes and sign-ins”Open Appliance › Log › Activity. Every role can see each change and sign-in. Retention and export are described under Audit and compliance. See also The hash chain.
Script policy values
Copy link to the section “Script policy values”The value is the sum of the types the service agent may run. 0 blocks everything, including signed integrations.
| Value | Allows |
|---|---|
| 1 | FairSSL integrations that read |
| 2 | FairSSL integrations that change things |
| 4 | Integrations from others that read |
| 8 | Integrations from others that change things |
| 16 | Your own integrations |