Deployment Targets
A deployment target tells SSL Nexus where certificate material must be installed, which built-in application owns the deployment, which management channel is used, and which certificate authority is authorised for that target.
Built-In Application Mapping
| Application | Platform | Management Connection |
|---|---|---|
| Nginx | Linux | SSH |
| Apache | Linux | SSH |
| IIS | Windows | WinRM + NTLM |
| PaperCut | Windows | WinRM + NTLM |
| SAP BI Launch Pad | Windows | WinRM + NTLM |
| IWMC | Windows | WinRM + NTLM |
| Palo Alto Networks PAN-OS / Panorama | Network | HTTPS XML API |
| F5 BIG-IP | Network | iControl REST over HTTPS |
| VMware vCenter | Network | vCenter REST API over HTTPS |
| Custom plugin | Linux or Windows | Selected by plugin |
Create A Target
- Open Deployment targets and choose Add target.
- Enter an inventory name plus the address/FQDN.
- Select the platform. Applications are filtered to compatible choices.
- Select the application and enter the management-channel credential/settings for that platform.
- For network targets, complete the application-specific appliance fields.
- Select the CA adapter for this target and enter its settings/credentials.
- Save the target.
- Run Test connection for the management channel and Test CA for the certificate authority.
Linux Targets
Use the Linux SSH setup block to create/prepare the dedicated service account and install the SSL Nexus public key. The generated setup grants the non-interactive sudo privileges required for controlled Ansible deployment.
For built-in Nginx/Apache deployment, SSL Nexus can prepare the normal TLS packages it needs when missing. Existing supported packages are not unnecessarily reinstalled.
Windows Targets
Windows applications use WinRM with NTLM on 5985/5986. Use a dedicated management identity with the permissions required by the application and target. See Prepare Windows targets.
Network Appliance Targets
Network appliances use their native HTTPS management API rather than SSH or WinRM. API credentials are encrypted in the target store and are not returned after saving. Administrators can delegate management of this target class to the Network Operator role.
PAN-OS/Panorama XML API, appliance-held private key, signed-certificate import and commit tracking. Palo Alto guide.
iControl REST, managed certificate/key objects and explicit Client SSL profile binding. F5 BIG-IP guide.
Two-stage Machine SSL workflow where vCenter generates and retains the private key. VMware vCenter guide.
Test Connection And Test CA
Test connection uses the same management-channel family as deployment: SSH for Linux, WinRM/NTLM for Windows, or the authenticated native API for supported network appliances. A healthy result means SSL Nexus authenticated and completed an application-level check, not simply that a TCP port answered.
Test CA is independent. It checks the certificate authority bound to the selected target. Keeping these health states separate makes it possible to diagnose appliance credentials, network reachability and CA credentials without mixing the failure domains.
Network Placement
In segmented environments, permit the SSL Nexus management network to initiate only the paths it needs: normally SSH/22 to Linux, WinRM/5985 or 5986 to Windows, and HTTPS to the management interfaces of supported network appliances. CA/API egress should likewise be limited to the configured certificate authorities.
Credential Handling
Linux SSH keys, Windows credentials, network-appliance API credentials and target-bound CA credentials are managed separately. Network target credentials are encrypted in the deployment-target store. Leaving a credential field blank while editing an existing target keeps the current secret where supported; changing an adapter or identity should be treated as an explicit credential rotation.
Custom Applications
Enterprise custom plugins can target Linux or Windows and define deployment, test, verification and rollback playbooks. Declare plugin secret names in the manifest; SSL Nexus stores secret values separately and injects them only during execution.