When something does not work
Copy link to the page “When something does not work”Find what you see on screen and follow the action in the matching section.
The appliance cannot open its keys
Copy link to the section “The appliance cannot open its keys”What you see: Cloud sign-in is unavailable after a restart.
Why: The vault containing the private keys cannot open because the connection to sslbrain Cloud (EU) is unavailable.
Do now: Restore the Cloud connection. If you need access meanwhile, choose Lost access? Use backup words, enter the 12 words and click Log in with backup words. You become Admin Local, see Emergency access.
Installation locked
Copy link to the section “Installation locked”What you see: Installation locked.
Why: Another machine is using the same identity, or the appliance has been restored from a backup.
Do now:
- Shut down any clone of the appliance.
- Click Use backup key instead.
- Enter the 12 backup words, separated by spaces, in Emergency key and click Unlock.
Overview opens with a message that the vault is unlocked. If you have neither cloned nor restored, contact FairSSL: another machine may be trying to take over the identity.
The installation has been retired
Copy link to the section “The installation has been retired”What you see: This installation has been retired.
Why: The licence was moved to another appliance.
Do now: Use the appliance holding the licence. To retrieve data from the retired one, choose Use backup key instead, see Move the licence.
The appliance is awaiting confirmation
Copy link to the section “The appliance is awaiting confirmation”What you see: Awaiting confirmation with a request ID.
Why: Reconnection through sslbrain Cloud has been requested.
Do now: Choose Back to lockdown, then Use backup key instead, and unlock with the 12 backup words. Contact FairSSL if you did not create the request.
The appliance cannot reach sslbrain Cloud
Copy link to the section “The appliance cannot reach sslbrain Cloud”What you see: Cloud connection shows Not connected under Appliance › Licence and status › Status, or the update check cannot reach Cloud.
Why: DNS, a firewall or a proxy may block outbound HTTPS.
Do now: Choose 2 Test the connection to sslbrain Cloud in the virtual appliance’s console. NAME DOES NOT RESOLVE → correct DNS through the console menu. NO ANSWER → allow outbound TCP 443 to cloud.sslbrain.com, acme.sslbrain.com and registry.sslbrain.com. For Docker, check the same access from the host.
Certificates on servers work until expiry. A local password and direct SMTP and webhook notifications can be used meanwhile. Orders through Cloud wait for the connection.
A service agent does not check in
Copy link to the section “A service agent does not check in”What you see: The server’s page says the service agent has not checked in, or Needs action shows it as offline.
Why: The service may have stopped, or the server cannot reach the appliance’s address and port.
Do now: Open PowerShell as administrator on the Windows server:
Get-Service sslbrainagentTest-NetConnection -ComputerName <appliance-address> -Port 443- The service has stopped → run
Restart-Service sslbrainagent. If it stops again, read the service agent’s log. TcpTestSucceededisFalse→ allow outbound HTTPS to the appliance. Use the chosen external HTTPS port if it is not 443.- The address changed → change the connection address. Outside the network, you can use a connection via sslbrain Cloud, E2E.
- The server runs Linux → follow Linux log files.
- The appliance was restored from a backup → the service agent receives work once it has answered the appliance’s challenge, see Restore.
A server without a service agent cannot be reached
Copy link to the section “A server without a service agent cannot be reached”What you see: Offline under Servers › All servers. The server’s page shows the reason.
Why: The server does not respond over SSH or API, or it rejects the credentials.
Do now: Open the server and click Test connection. No answer from the server → check access to its SSH or HTTPS port. Login rejected → correct the login under Servers › Credentials, see Servers without a service agent.
Domain validation fails
Copy link to the section “Domain validation fails”What you see: The order says the CA cannot find the DNS record or DNS access is missing.
Why: The CA cannot see the DNS proof that the domain is yours. ACME is the protocol a CA uses to issue certificates automatically.
Do now: Follow the error shown in the order:
- CNAME missing → create the specified AutoDNS (CNAME) forwarding record in public DNS. A record in internal DNS is not enough.
- DNS API cannot create the record → click Test access and correct the key’s permissions at the DNS provider, see DNS API.
- Rate limit → wait until the CA accepts orders again.
- Cloud cannot be reached → restore the connection.
For AutoDNS (CNAME), check the public record in PowerShell:
Resolve-DnsName -Server 1.1.1.1 -Type CNAME _acme-challenge.<domain>The answer must be the AutoDNS name shown under Issuance › Domains.
A certificate is not renewed
Copy link to the section “A certificate is not renewed”What you see: The certificate is approaching expiry, Renewal failed has been sent, or the certificate source shows an error.
Why: Validation, connectivity, the licence or the certificate source can stop issuance. Manual import is not renewed automatically.
Do now: Open the certificate under Certificates › Certificates and follow the status box’s action.
- Validation fails → correct domain validation.
- Licence missing → check the licence.
- Queued, expected at … → wait until that time. The order is sent automatically. If issuance is paused for the account, contact FairSSL.
- No installation plan → create an installation plan.
- Renewed but not installed → follow Installation on the server fails.
Installation on the server fails
Copy link to the section “Installation on the server fails”What you see: A run shows Failed, or you receive Deployment failed.
Why: The run’s output shows whether the connection, permissions or integration failed.
Do now:
- Open Installation plans › Runs and open the failed run.
- Correct the cause in the output. See service agent offline or server unreachable if that is the error.
- Click Try again. This needs at least Operator.
If installation does not happen on renewal, check that the installation plan is active and Install on renewal is on. A maintenance window can postpone installation, see Runs.
Sign-in fails
Copy link to the section “Sign-in fails”What you see: The sign-in page rejects the attempt or says the session has expired.
Why: The sign-in method is wrong, access is missing or the session has expired.
Do now:
- Email or password is incorrect → if the Cloud account uses GitHub, Google or Microsoft, choose Log in with sslbrain Cloud.
- Too many login attempts → wait the number of seconds shown.
- Cloud authentication is unavailable → check the connection.
- You do not have access to this installation → grant the account access through Team in sslbrain Cloud.
- The licence allows no more logins → check the licence’s user allowance.
- The session expired → sign in again.
If nobody can sign in, use Lost access? Use backup words. Then set a local password for emergency access.
The update fails
Copy link to the section “The update fails”What you see: Last update shows Aborted, the version did not change, or Update log shows an error.
Why: The version could not be downloaded, verified or started. The appliance continues running the version it had.
Do now: Read the reason in the log:
- Not enough space → free space.
- The version could not be downloaded → check access to
registry.sslbrain.com, see Cloud connection. - The signature could not be verified → stop and download a support bundle.
- The version could not start or respond correctly → read the controller log under
4 View logsand2 The controller: updates, restarts, signature checks, then download a support bundle. - A compose override pins a version → remove the pinned image version from the host’s override file and update again.
If the offered version is unsigned, wait for a signed version under Updates.
The licence has expired or is too small
Copy link to the section “The licence has expired or is too small”What you see: Licence expired, servers marked Disabled, or rejection when creating an installation plan.
Why: The licence no longer covers all servers or installation plans. An expired licence falls back to Free. Servers without a licence receive neither certificate renewals nor installations.
Do now: Renew or upgrade in sslbrain Cloud, or delete servers you no longer use. The oldest servers are covered first. During setup, you can release an occupied licence. The message about a Free licence on the IP address means one is already registered; use its associated installation.
The disk is filling up
Copy link to the section “The disk is filling up”What you see: Low disk space at 80 % or Critically low disk space at 90 % under Needs action.
Why: Backups, versions and logs use the same disk. At 90 %, backups and updates that would fill it are refused.
Do now:
- Download the backups you want to keep and delete the others under Appliance › Maintenance › Backup.
- On the virtual appliance, choose
7 Free disk spacein the console to remove unused images. - If space is still insufficient, extend the virtual disk using the console instructions. For Docker, free space on the host.
You still need help
Copy link to the section “You still need help”What you see: The error persists after the action in the section above.
Why: FairSSL needs status and logs to investigate the error.
Do now: As an administrator, open Support › Help › Support bundle and click Create support bundle. Send the file and the time of the error to info@fairssl.dk. The bundle removes passwords, tokens and private keys but includes hostnames and IP addresses, see Support and diagnostics.