Settings
All settings are accessed via the gear icon in the top menu or Settings in the side menu.
General
| Setting | Description |
|---|---|
| Hostname | sslbrain server's FQDN. Used in agent registration and certificate links. |
| Timezone | Timezone for UI and log display. All internal timestamps are UTC regardless of this setting. |
Security
Users
Create, edit and delete local users. Each user is assigned a role: Admin, Operator or Viewer. See Security for role descriptions.
Password policy
Set minimum requirements for passwords: minimum length (default 12 characters) and requirements for uppercase/lowercase letters, numbers and special characters.
LDAP / Active Directory (Pro+)
Connect sslbrain to your Active Directory or LDAP server. Configure:
Server
LDAP server address (e.g. ldaps://dc01.example.com:636)
Base DN
Search base (e.g. DC=example,DC=com)
Bind user
A service user with read access to AD
Group filter
Map AD groups to sslbrain roles (e.g. SSLBrain-Admins → Admin)
Tip: Click Test connection to confirm the setup before saving.
Vault
| Setting | Description |
|---|---|
| Unseal mode | Switch between auto-unseal, manual password and HSM/YubiKey. See Security. |
| Change password | Changes the vault password. Requires the current password. |
| Export backup key | Downloads an encrypted backup key. Store it in a safe place outside sslbrain. Used for disaster recovery if you lose access to the vault. |
Note: Store the backup key in a safe place. Without it and your password, the vault cannot be recovered.
Notifications
sslbrain sends notifications on important events: certificate issued, renewal failed, server offline, vault sealed, etc.
Channels
| Channel | Setup |
|---|---|
| Default. Configure SMTP server, sender and recipients. | |
| Slack | Provide a Slack webhook URL. Messages are sent to the channel the webhook is configured for. |
| Webhook | Generic webhook. sslbrain sends a POST request with a JSON payload to your URL. |
| Telegram | Provide bot token and chat ID. |
Tip: Click Test next to each channel to send a test message and confirm the setup works. You can configure multiple channels simultaneously, e.g. email to the operations team and Slack to a monitoring channel.
ACME Accounts
Manage your ACME accounts with the various CAs:
Add account
Create a new ACME account with a CA (Let's Encrypt, Google Trust Services, etc.)
EAB credentials
Some CAs require External Account Binding. Enter Key ID and HMAC key here.
Remove account
Remove an ACME account from sslbrain. Certificates issued via the account are not affected.
sslbrain automatically creates a Let's Encrypt account on the first certificate issuance, if you don't already have one.
HTTPS certificate and hostname
The appliance creates a self-signed certificate on first start. Under Settings > Network and access you choose the hostname and where the web interface's certificate comes from.
Hostname
- Free hostname under
my.sslbrain.net, for exampleoffice01.my.sslbrain.net. Requires the appliance to be connected to sslbrain Cloud. The label is 6-10 lowercase letters or digits with at least one letter. You can change the name three times in seven days, and the page shows how many changes are left. A name registered undersslbrain.netbefore the move, such asbrain00.sslbrain.net, is kept until you choose a new one. - Your own hostname in your own domain.
- IP address only, with the self-signed certificate.
Certificate source
| Source | What happens |
|---|---|
| Self-signed (default) | The browser warns. Check the fingerprint against the one on the console menu's status screen. |
| Rule in sslbrain | A free certificate through sslbrain Cloud, kept by an ordinary rule. See below. |
| Manual upload | You upload server.crt and server.key and renew them yourself. |
With Rule in sslbrain the appliance's own certificate sits in your rule list like any other rule. The appliance appears as a server in the server list, the built-in sslbrain-appliance agent installs the certificate, and the source is the Default profile on your sslbrain Cloud account, with Let's Encrypt first and Google Trust Services as the fallback. The same renewal check as for your other certificates renews and deploys it. You can change the rule's source, key type or name, or delete it. The appliance's own server does not count towards the licence.
Your own domain: A hostname outside my.sslbrain.net needs a CNAME for _acme-challenge pointing to sslbrain Cloud before the rule can issue.
License
Here you can see your license level and what it includes:
| Field | Description |
|---|---|
| Level | Community, Pro or Enterprise |
| Server limit | Maximum number of servers you can manage |
| Features | List of available features for your level |
| Expiry date | License expiry date (or "No expiry" for Community) |
Upgrade or renew the license directly from here. Changes take effect immediately.
Updates
| Setting | Description |
|---|---|
| Automatic updates | Enable or disable automatic updates. When enabled, sslbrain installs new versions automatically in a maintenance window (default: Sunday night). |
| Check now | Check if a new version is available and install it immediately. |
Tip: sslbrain automatically creates a backup before updating and rolls back if something fails. See Troubleshooting for details.
Network
| Setting | Description |
|---|---|
| Proxy | Configure an HTTP proxy for outbound connections. |
| Outbound IP whitelist | Shows the IP addresses sslbrain connects to (Cloud servers and CAs). Use the list for firewall configuration. |
Script policy
The script policy decides which scripts new service agents may run: FairSSL only, FairSSL + Community or All including custom. It is under Settings > Script policy. The old address under Automation redirects there.
Diagnostics
Diagnostics is one on/off switch under Settings > Diagnostics. While it is on, the appliance sends the chosen sections to FairSSL on every exchange with sslbrain Cloud, about every 15 minutes, until someone switches it off. While it is off, nothing is sent. There are no sessions, no expiry and no second consent step.
The checkbox in the setup wizard is the same switch: ticked means all eight sections are shared from the first exchange. The page shows who switched diagnostics on or off and when, and every change is written to the audit log. Sent packets lists what was sent: time, sections, number of records and size.
The eight sections
| Section | What is sent |
|---|---|
| Application log | New lines from the appliance's own log and the process logs, from the moment diagnostics are switched on. |
| Service agent runs | Tasks sent to service agents: type, status, times, and the agent's hostname, OS version and version. |
| Push agent runs | Deployments by push agents: agent and version, endpoint, action, status, exit code and duration. |
| Error log | Only the error lines from the same logs. |
| Certificate metadata | Name, SANs, issuer, serial number, validity, key type and fingerprint. Never private keys. |
| Certificate sources | Which certificate sources are set up, and how, without passwords and API keys. |
| Server inventory | Server name, hostname, IP address, operating system and connection status. |
| Automation | Plans: strategy, maintenance window and whether renewed certificates are deployed automatically. |
Passwords, tokens, API keys and private keys are removed on the appliance before anything is sent. Data is sent signed over HTTPS to sslbrain Cloud at FairSSL A/S, and FairSSL deletes received data after 30 days.
While the application log is shared, the appliance logs at debug level so the log has enough detail to find the fault. When diagnostics is switched off it returns to info.
Switching off: It takes effect at once. Nothing more is sent, anything waiting to be sent is deleted, and sslbrain Cloud is told. Data FairSSL has already received is deleted after the 30 days.