Credentials do not belong in someone else’s cloud
Certificate automation needs admin access to firewalls, load balancers, and servers. Put those credentials into a SaaS product and its vendor effectively holds access to your infrastructure. sslbrain runs as an appliance inside your own network, so SSH keys, WinRM credentials, and API tokens stay behind your firewall.
Outbound traffic only
The appliance needs outbound HTTPS to cloud.sslbrain.com for licensing and updates and to acme.sslbrain.com for certificate issuance. No inbound connections from the internet are required, and we have no remote access to your installation. The fixed IP addresses are documented so your firewall can be locked down accordingly.
Encrypted vault
Private keys and credentials are stored in an encrypted vault on the appliance. The master key never leaves the appliance; the cloud service holds only a key encryption key, which cannot decrypt your data on its own. A stolen copy of the database is useless. The full design is described on the architecture page.