Servers and endpoints

What is a endpoint?

A endpoint is a server or device that sslbrain manages certificates on. The count is per physical or virtual server, not per certificate or service.

It is the server or device that is counted, not what runs on it. You can have many certificates and services on the same endpoint at no extra cost.

Add Windows Server (Service Agent)

Service Agent is the recommended method for Windows servers. The agent requires no open inbound ports, it calls out to sslbrain via HTTPS on its own.

Setup

1. Go to Downloads in sslbrain and download Windows Agent (.msi)
2. Copy the MSI file to the Windows server
3. Run the installation, standard Windows installation: next, next, finish
4. The agent starts automatically as a Windows Service

Within approximately 1 minute, the server appears under Servers with status "Online". No further configuration is needed.

What the agent finds

The agent scans the server and reports:

Everything is displayed under the server's Services tab.

Why agent over WinRM?

The only prerequisite is that the server can reach sslbrain on port 8443 (or the port you have configured).

WinRM (alternative)

Use WinRM if you cannot or prefer not to install the agent. WinRM is Windows' built-in remote management protocol.

Prerequisites

WinRM must be enabled on the server. Run this in an administrative PowerShell:

winrm quickconfig

Ensure one of these ports is open in the firewall:

Setup in sslbrain

1. Click Servers > Add server
2. Select Windows (WinRM)
3. Fill in:
   • Hostname/IP: the server's FQDN or IP address
   • Port: 5985 or 5986
   • Credentials: domain user or local administrator
4. Click Test connection
5. Click Save

sslbrain finds the same services as the agent (IIS, Exchange, RDP, ADFS, SQL).

Add Linux Server (SSH)

SSH is the standard method for Linux servers. sslbrain connects via SSH and automatically discovers web server configurations.

Setup

1. Click Servers > Add server
2. Select Linux (SSH)
3. Fill in:
   • Hostname/IP: the server's FQDN or IP address
   • SSH port: default is 22. Only change if you use a different port
   • Credentials: select an existing credential or create a new one (see the credentials section)
4. Click Test connection

A green checkmark means sslbrain can reach the server and log in. Click Save to add the server.

What sslbrain discovers

After adding, sslbrain scans the server and automatically finds:

• Nginx: all server blocks with listen 443 or ssl_certificate directives
• Apache: all VirtualHost configurations with SSL enabled
• Existing certificates: certificates already installed, with expiry date and chain validation

The results are displayed under the server's Services tab within a few seconds.

Requirements for the SSH user

Add Network Device

sslbrain supports network devices that do not run a standard OS. The connection method depends on the device.

FortiGate

FortiGate firewalls are managed via SSH CLI.

1. Click Servers > Add server
2. Select Network device > FortiGate
3. Fill in hostname/IP, SSH port (default 22) and admin credentials
4. Click Test connection

sslbrain finds certificates used for VPN, admin interface and SSL inspection.

NetScaler (Citrix ADC)

NetScaler is managed via REST API (NITRO).

1. Click Servers > Add server
2. Select Network device > NetScaler
3. Fill in:
   • Hostname/IP: NetScaler's management IP
   • Port: typically 443
   • API credentials: username and password for NITRO API
4. Click Test connection

sslbrain finds all SSL vServers and their certificate bindings.

Discovery

When you add a server, sslbrain automatically runs a scan. You can also run a scan manually from the server's overview page.

Scanning finds:

Results are displayed under the server's Services tab with a status indicator per service.

Credentials

Credentials are stored encrypted in sslbrain's vault and can be reused across servers.

Types

Create a credential

1. Go to Settings > Credentials
2. Click New credential
3. Select the type, enter a descriptive name (e.g. "Linux service account" or "FortiGate admin") and fill in the fields
4. Click Save

Security

• Credentials are encrypted with AES-256 in sslbrain's vault
• Private SSH keys are never stored in plaintext
• Credentials can only be used by sslbrain, they cannot be retrieved via the UI or API
• Delete a credential under Settings > Credentials if it is no longer in use

Best practice for service accounts

Linux

Create a user for sslbrain:

sudo useradd -r -m -s /bin/bash sslbrain-svc

Grant access to read web server configuration and write certificate files:

# Read Nginx/Apache configuration
sudo usermod -aG www-data sslbrain-svc

# Reload web server (add to sudoers)
echo "sslbrain-svc ALL=(root) NOPASSWD: /usr/sbin/nginx -s reload, /usr/sbin/apachectl graceful" \
  | sudo tee /etc/sudoers.d/sslbrain-svc

Use an SSH key instead of a password. Generate a key pair and upload the public key to the server.

Windows

Create a dedicated service account in Active Directory (or locally) with these permissions:

• IIS: Membership of the "IIS Admins" group or an equivalent custom group with permissions to manage bindings and certificates
• Certificate store: Read and write access to "Local Machine\WebHosting" and "Local Machine\My"
• Exchange: The "Server Management" role in Exchange
• WinRM: Membership of the "Remote Management Users" group

Network devices

Create a dedicated admin user with only the permissions necessary for certificate management:

• FortiGate: Create an admin profile with access to "VPN" and "System" → "Certificates". No access to firewall rules or routing.
• NetScaler: Create a user with sslCertKey privileges via a custom command policy.