The certificate has to land on the server
Issuing a certificate is the easy part. The hard part is installing it correctly on an Exchange server, binding it in IIS, reloading HAProxy, or updating a NetScaler without downtime. The integrations in sslbrain handle that step. Each integration page describes the platform’s installation, validation, and recovery options; a separate rollback action is listed only where the integration supports it.
Locally via service agent or push installation
Push integrations run from the appliance over SSH or APIs to network equipment, hosting panels, virtualisation, and cloud services. The service agent fetches its tasks and installs locally on Windows and Linux servers. The Windows service agent is an MSI package you can roll out via GPO, SCCM, or Intune. It fetches tasks from sslbrain over outbound HTTPS, so there are no firewall openings into the server.
Signed code, your policy
Every integration is signed with ECDSA P-384, and every server carries a ScriptPolicy deciding what it accepts: integrations from the FairSSL catalogue, written and signed by FairSSL, and optionally your own integrations. Browse the full catalog on the features page and the principles under policy management.