Support and diagnostics

Send fault details through sslbrain Cloud (EU) to FairSSL so support can investigate the problem.

What you need

An administrator login for the appliance.
A short description of the fault and when it occurred.

Support bundle

A support bundle is a JSON file with what support needs to find a fault. Only administrators can download and send it.

Open Support › Help.
Click Send to sslbrain Cloud and confirm with Yes, send to sslbrain Cloud.
Note the reference under Support bundles sent.

Check that it works

The bundle’s reference appears under Support bundles sent. Send it with the fault description to info@fairssl.dk.

If it fails

The appliance cannot send to sslbrain Cloud (EU) → click Create support bundle and send the JSON file to support.
Hostnames and IP addresses must stay in your network → download and review the bundle before sending it.
The web interface will not open → use the console menu to see the status and address.

The bundle is sent only when someone clicks the button.

The bundle contains system information, database migration status, the queue, open orders, storage use, recent deployments with integration output, the stages of service agent tasks, installation plan runs, service agent and integration versions, the last 100 lines of the application log, and every setting.

Removed before download and sending are known secret values, encrypted settings (shown as [ENCRYPTED]), settings with names such as password, secret, key, api_token and hmac (shown as [REDACTED]), and text that looks like passwords, tokens, private keys, Bearer and Basic headers, and connection strings.

Support partner

A support partner is an IT partner who becomes the account’s support contact in sslbrain Cloud and can pass your cases on to FairSSL. The partner gets no access to the appliance.

Get an invite code from the partner.
Open the Support partner tab under Support.
Enter the code in Invite code and choose an expiry date at most 10 years ahead.
Click Approve.

Revoke access cancels the approval in sslbrain Cloud and on the appliance. Only administrators can approve and revoke.

Diagnostics

With diagnostics on, the appliance continuously sends selected information to FairSSL, so support can see a fault without asking you for a bundle. Diagnostics are off until an administrator switches on Share diagnostics with FairSSL under Support › Diagnostics. If you ticked Share diagnostics with FairSSL continuously during setup, they are on for every section.

While diagnostics are on:

the chosen sections are sent to sslbrain Cloud about every 15 minutes, signed and over HTTPS;
passwords, tokens, API keys and private keys are removed on the appliance before anything is sent;
the appliance logs at debug level for as long as the application log is shared;
FairSSL deletes the data it receives after 30 days.

If you switch diagnostics off, nothing more is sent, and anything waiting is deleted.

You choose the sections:

Section	Contents
Application log	New lines from the appliance’s own log and the process logs
Service agent runs	Tasks sent to service agents: type, status, times, and the agent’s hostname, OS version and version
Runs using push from the appliance	Installations using push from the appliance: integration and version, service, action, status, exit code and duration
Error log	Only the error lines from the same logs
Certificate metadata	Name, SAN, issuer, serial number, validity, key type and fingerprint. Never private keys
Certificate sources	Which sources are set up, and how, without passwords and API keys
Server inventory	Server name, hostname, IP address, operating system and connection status
Automation	The installation plans’ strategy, maintenance window, and whether renewed certificates are deployed automatically
Appliance health	Memory, CPU and disk hour by hour, start-ups, upgrades, and processes that have crashed. No hostnames, domains, IP addresses or certificates

SSH for troubleshooting

Only someone with access to the appliance’s local console can open SSH for troubleshooting, for 24 hours. Even then, it requires access to the appliance on your network. FairSSL support can then log in. This applies to the virtual appliance (OVA and qcow2). An appliance in Docker does not have this option.

Open the virtual machine’s console in the hypervisor.
Choose 9 Danger zone, then 2 Temporary SSH for support.
Answer yes to “Open temporary SSH for 24 hours?”.
Give support the appliance’s address. It is shown under 1 Status. Support must be able to reach it on port 22 or 10022.

SSH accepts only the FairSSL support keys built into the image, never a password. Support logs in as root. SSH closes itself after 24 hours, also if the machine is restarted. Close it early from the same screen.

SSH is off by default and cannot be opened remotely or from the web interface. No tunnel runs through sslbrain Cloud.

Licence and status

Appliance › Licence and status contains these tabs. Administrator tabs are shown only to administrators:

Tab	Shows
Status	Licence, Audit log, effective Service window, hostname, version, Cloud connection, last heartbeat, installation date and identity (all users)
Modules	Module licence access and activation (administrator)
System	Status, Restart, Stop sslbrain and Recent activity with the last 50 system actions (administrator)
Operation mode	Operation mode and automation (administrator)
Domain lock	Domain limit on Free (administrator)
Licence	Opens the licence in sslbrain Cloud (administrator)

Restart restarts sslbrain, and the page reconnects by itself. Stop sslbrain stops sslbrain, but not the operating system.