sslbrain Cloud

Use sslbrain Cloud (EU) for your account, licence and access to your appliances.

What you need

An email address for the account.
Access to the appliance if you need to activate it.

Create and open the account

Create an account at sslbrain.com/cloud/register with an email address and password.
Confirm the email address using the link in the email.
Sign in at sslbrain.com/cloud/login.

Check that it works

You can open Appliances and Licences and units. The appliance fetches its licence from sslbrain Cloud. Your certificates, private keys and settings are held on the appliance.

If it fails

No activated appliance in the list → complete First-time setup.
You can see invoices but no appliance → ask the account’s Owner or Administrator for access under Team.
The appliance cannot reach sslbrain Cloud → check the connection from the console menu.

Account settings

Two-Factor Auth protects sslbrain Cloud sign-in with an authenticator app (TOTP). Save the recovery codes so you can sign in without the app. The account can remember trusted devices. Local passwords and AD sign-in on the appliance do not use Cloud two-factor authentication.
Notifications holds the email addresses, at most 10, that alerts from the appliance’s E-mail (Cloud) channel go to. If none are listed, they go to the account owner. See Keep an eye on your certificates.

Each user enables two-factor authentication individually. Organisations cannot require it for all users.

Roles in sslbrain Cloud

Role	Can
Owner	Everything
Administrator	The same as Owner, except renaming the AutoDNS name
Operator	Day-to-day work and certificate setup. Sees licences and the team, nothing to do with payment
Viewer	View, not change
Billing	Licences, purchases, invoices, the data processing agreement and payment events in the Audit log. No access to appliances

When you sign in to the appliance with sslbrain Cloud, the role here also sets the role on the appliance. See Users and sign-in.

Appliances

Appliances shows every appliance activated with the account: hostname, tier, licence, version and last contact. An appliance appears in the list when someone signs in to it with the account and chooses a licence.

Click an appliance to see:

Overview: appliance id, IP address, registration date, and the Display name the appliance is shown with in the portal.
Licence: the licence history, and Switch licence to another of the account’s licences. The appliance keeps its identity, data and certificates.
Certificates: the certificates sslbrain Cloud has issued to the appliance.
AutoDNS names: the names the appliance uses for CNAME delegation.
Danger zone: release the licence. See Move the licence to another appliance.

Only Owner and Administrator can switch and release licences.

Downloads and requirements

Downloads and requirements at the bottom of the menu has the files and requirements for a new appliance. Every role except Billing can open the page once the account has accepted the licence terms and the data processing agreement. Your licences shows the licences a new appliance can take.

File	For
OVA	VMware and other hypervisors that import OVF
qcow2	KVM, libvirt and Proxmox
`docker-compose.yml`	Docker on your own Linux server

Docker: follow the installation guide. For an existing Compose installation, see adding the controller.
OVA and qcow2: the page lists version, size and SHA-256. The VM image version is the date the image was built. The first time the machine starts, it installs the newest signed version of sslbrain. The OVA and qcow2 files are not signed; the appliance image they fetch is. See Security.

ACME is the protocol a CA uses to issue certificates automatically.

Requirements:

Virtual appliance: 2 vCPU, 4 GB RAM and 40 GB disk (thin provisioned).
Docker: Docker 24.0 or newer, Docker Compose v2, 4 GB RAM, 20 GB disk space and access to the CAs’ ACME endpoints.
Outbound HTTPS (443) to registry.sslbrain.com, cloud.sslbrain.com and acme.sslbrain.com.
The virtual appliance also needs outbound HTTP (80) to archive.ubuntu.com and security.ubuntu.com for operating system security updates.
No inbound ports from the internet.

All ports, including those on your own network, are under Security.

Licences and units

A licence belongs to one appliance and sets how much it can manage. There are four tiers: Free, Basic, Professional and Enterprise.

Limit	Free	Basic	Professional	Enterprise
Servers	5	50	50 to 500 by licence	100 to 1,000 by licence
Installation plans	10	100	two per server	two per server
Logins	1	3	10	No licence limit
Domains per account	2	No licence limit	No licence limit	No licence limit
Names per certificate	100	CA limit	CA limit	CA limit
Certificate profiles	1	3	No licence limit	No licence limit
Own integrations	1	3	No licence limit	No licence limit

CA limits and the daily issuance limit still apply where the licence has no limit. Certificates and renewals are included at no extra charge, except commercial certificates paid for with units.

Feature	From
Alerts by E-mail (SMTP) and Webhook	Basic
Certificate upload	Basic
Alerts in Slack, Microsoft Teams and Telegram	Professional
Service agents via sslbrain Cloud	Professional
Maintenance windows	Professional
Audit log export	Professional
Alerts in PagerDuty and OpsGenie	Enterprise
Windows CA	Enterprise, plus an add-on that FairSSL switches on for the licence

Servers: the licence covers the oldest servers up to the limit. Servers beyond the limit are deactivated and shown as unlicensed. A new server is never refused.
Installation plans: capacity is listed in the table. A paused installation plan counts; the appliance’s own does not.
A paid licence expires: the appliance falls back to Free. The licence becomes a Free licence on the appliance it was on, and cannot be used on another.

Every account has a Free licence from the start. The appliance’s page Appliance › Licence and status › Licence opens Licences and units in sslbrain Cloud.

Units

Units pay for the commercial DV certificates sslbrain Cloud issues. Cloud sells DV certificates only. The same unit calculation applies to every CA:

One name uses one unit. Its www.<name> companion is free.
One wildcard uses three units. Its base domain is free.
Several names use one base unit plus one unit per name and three per wildcard name. Two names use three units. One name and one wildcard use five units.
Each further name uses one unit. Each further wildcard uses three.

A 20 % unit surcharge applies when the domain can only be validated with DigiCert’s persistent TXT record. AutoDNS (CNAME) removes the surcharge. See unit prices.

Units are deducted when a paid certificate is issued, and are held by open orders.
The balance plus the credit limit FairSSL has set must cover the order.
Buy units creates an invoice straight away. Pay by card or bank transfer.
Owner, Administrator and Billing can buy.
The account receives an email when the balance is low.

Which certificates a profile can fetch: Choose where certificates come from.

Team

Give colleagues access to one or more appliances.

The Operator and Viewer roles come with Professional and Enterprise, both in sslbrain Cloud and on the appliance.

Open Team and find Add a person.
Enter the email address, choose the appliances, and choose the role: Administrator, Operator or Viewer. If the person should only see licences and invoices, choose Billing and no appliance.
Click Add.

If the person is already a member of the account, they have access straight away. Otherwise an invitation is sent that is valid for 7 days. It can be resent or revoked.

The Owner role cannot be assigned.
Nobody can change their own role.
Owner and Administrator manage the team. Operator can see it.

The team page shows, for example, “3 of 10 logins”. The count is every user plus pending invitations, across all the account’s appliances. The appliance counts its own logins, see Users and sign-in.

Move the licence to another appliance

Data does not move with the licence. Certificates, private keys, service agents and settings stay on the appliance you are leaving.

Open Appliances in sslbrain Cloud and click the appliance you are leaving.
Find the card Move this licence to another machine under Danger zone, and click Release the licence. This needs Owner or Administrator.
Type release and click Release it. The appliance keeps running until the new one takes over the licence.
Set up the new appliance as in First-time setup. When you choose a licence, choose Move the licence from and the name of the appliance you are leaving.
Set up the rest as in steps 3 to 8, starting from A name and certificate for the appliance.

When the new appliance takes over the licence, the one you are leaving is retired. It shows This installation has been retired and no longer serves anything. Its local data can still be opened with the 12 backup words.

When to move, and how to restore on the same machine: Move or restore the appliance.
To reinstall only the software on the same virtual machine, use 6 Reinstall the appliance software in the console menu. Data is kept, and the licence does not need to move.