Installation And First Access

SSLNexus is delivered as a native Linux package. Review System requirements first, prepare the control-plane DNS hostname, then install the package and complete first-administrator setup.

1. Prepare The Server

1. Provision a supported 64-bit Linux server. A dedicated VM/server is recommended for production.
2. Create the DNS hostname that will identify the SSLNexus control plane, for example nexus.example.org.
3. Confirm working DNS, accurate system time and package-repository access.
4. Confirm routing to the CA endpoints and deployment target networks you will manage.
5. If public Let's Encrypt will secure the control-plane hostname, make TCP 80/443 reachable at the SSLNexus Nginx frontend.

2. Install The Package

# Debian / Ubuntu
sudo apt install ./ssl-nexus-client_<version>_amd64.deb

# RHEL / Rocky / AlmaLinux
sudo dnf install ./ssl-nexus-client-<version>-1.x86_64.rpm

An interactive first install prompts for the SSLNexus hostname. For unattended Debian/Ubuntu installation, preseed it with SSL_NEXUS_DOMAIN=nexus.example.org; use the equivalent environment in your RPM automation.

The package creates the service account, protected state/secrets, Nginx frontend, systemd units, automation key material and normal runtime dependencies. Existing supported dependencies are reused.

3. First Access

SSLNexus does not intentionally expose the administrator UI over public clear-text HTTP.

If HTTPS Is Already Available

The installer prints an HTTPS setup URL such as https://nexus.example.org/setup/<temporary-token>.

If The Control-Plane Certificate Is Not Yet Available

Use the SSH tunnel printed by the installer, normally:

ssh -L 8088:127.0.0.1:80 root@<ssl-nexus-server>

Then open the local setup URL printed by the installer, for example http://127.0.0.1:8088/setup/<temporary-token>.

If the token expires before setup completes, run sudo ssl-nexus-admin setup-link locally.

4. Create The First Workspace

1. Create the organisation/workspace.
2. Create the first named Administrator.
3. Accept the SSLNexus EULA.
4. Enter the administration interface.

A new installation starts on the permanent Free tier. The optional seven-day Trial is started explicitly from Product licence settings.

5. Secure The Control-Plane Hostname

A certificate request whose name exactly matches the configured SSLNexus hostname is handled locally. It does not go through remote Nginx/Apache target discovery.

1. Confirm the hostname resolves to the server.
2. Configure the required CA connector.
3. Create/request the certificate for the SSLNexus hostname.
4. Allow SSLNexus to install it into the local Nginx frontend.
5. Verify normal access at https://<ssl-nexus-hostname>/admin/.

The ssl-nexus-admin ui-cert command remains available for recovery/scripted use, but the normal workflow is to manage the control-plane certificate through SSLNexus.

6. Run Production Preflight

sudo ssl-nexus-admin preflight

Preflight checks service/version health, Nginx, Ansible, OpenSSH, OpenSSL, protected paths, free state-filesystem space and Windows automation prerequisites where applicable.

7. Add Targets And CAs

Connect the organisation's CA adapters, then register deployment targets and run Test target before assigning production certificates. Linux uses the generated SSH setup block; Windows uses WinRM with NTLM.

Built-in Nginx/Apache automation ensures the normal web-server TLS packages it needs are present on managed Linux targets. Already-installed packages are left alone.

8. Set The Renewal Checkpoint

Under Settings > Automatic renewal schedule, choose the UTC time when certificates already inside their renewal window should normally be queued. The default is 02:00 UTC. Manual renewal and retry jobs do not wait for the daily checkpoint.

9. Back Up And Restore

sudo ssl-nexus-admin backup
sudo ssl-nexus-admin backup --output /secure/path/ssl-nexus-backup.tar.gz
sudo ssl-nexus-admin restore /secure/path/ssl-nexus-backup.tar.gz

Backups contain sensitive persistent state, encrypted secrets and the licence installation identity. Protect them accordingly.

10. Upgrade

Install the newer DEB/RPM with the normal package manager. Before activation SSLNexus creates a consistent recovery snapshot under /var/backups/ssl-nexus/package-upgrades/. The new runtime must pass health, exact-version, Nginx and production-preflight checks. A failed activation is rolled back when a valid snapshot is available.

11. Remove Or Reinstall

Package removal stops SSLNexus and removes its active Nginx frontend, but intentionally retains persistent state under /etc/ssl-nexus and /var/lib/ssl-nexus. Take a current backup before removal and delete persistent state only as a separate retirement action.