Security Guidance

Treat SSLNexus as management infrastructure: restrict access, use dedicated automation identities and expose only the network paths required for certificate operations.

Keep the application backend on 127.0.0.1:8080 and the separate vendor backend on loopback. Expose only the Nginx endpoints required by the design.

For production, use a dedicated SSLNexus Linux server/VM where practical. Although coexistence is possible, a clean host reduces Nginx/port conflicts, dependency coupling and resource contention, and narrows the security boundary around CA credentials and automation keys.

Control-Plane Host Isolation

Administrative Access

Use named accounts for administrators and remove access promptly when responsibilities change. Protect the short-lived first-administrator setup URL until setup completes. Normal administrator access uses named accounts or the configured identity provider.

The Network Operator role is enforced by server-side API scope as well as the browser interface. It can mutate only network deployment targets and certificates bound to those targets. Linux/Windows targets, custom plugins, global settings, backups, licensing, vendor administration and certificate-import/ownership operations remain outside the role.

Network Operator Isolation

Otp, Enterprise SSO And Sessions

Local staff accounts can enable OTP from the Security page. Microsoft Entra ID, Okta, Google Workspace and Generic OIDC connections validate signed ID tokens and can require MFA evidence from the identity provider; LDAP / Active Directory remains available for directory-backed staff authentication.

The Security page also lists active sessions for the signed-in account. Sessions can be revoked individually or all at once. Disabling local OTP revokes existing sessions. Staff and Vendor Portal SSO authorisation are evaluated separately so a vendor identity cannot become a staff account through the shared identity connection.

Password And Sign-In Protection

New or reset local passwords must contain at least 14 characters. Five failed local sign-in attempts temporarily lock the account for 15 minutes. A successful sign-in clears the failed-attempt counter.

Network Design

For segmented networks, the preferred placement is a dedicated management or automation VLAN/security zone. Permit SSLNexus to initiate only the management connections required to approved targets across server, application and network VLANs. Do not grant the managed VLANs reciprocal access to the SSLNexus control plane merely because SSLNexus can reach them.

Restrict inbound administration to trusted management networks over HTTPS. Linux management should be limited to SSH, Windows management to the configured WinRM ports, and network-appliance management to HTTPS from the SSLNexus zone to the specific PAN-OS/Panorama, F5 BIG-IP or VMware vCenter interfaces being automated. Use explicit firewall rules rather than broad inter-VLAN access.

Secrets

Use dedicated credentials for CA APIs, Linux automation, Windows automation and network-appliance APIs. Network Operators can own and rotate the appliance credentials for their scoped targets without receiving access to unrelated server or platform secrets. Rotate them according to organisational policy and update SSLNexus immediately after a rotation. Do not place production credentials in gold images or shared documentation.

Browser Access

Publish the SSLNexus interface over HTTPS using a trusted certificate before broad administrator use. If a reverse proxy, load balancer or security gateway fronts SSLNexus, preserve the access controls and headers required by your environment.

Configuration Protection

Include SSLNexus in your normal server backup, recovery and monitoring policy. Protect backups to the same standard as the live management server because they may contain sensitive configuration.

Vendor SSO On A Separate Hostname

When the Vendor Portal is published on its own hostname, configure a separate Vendor OIDC redirect URL under Authentication & identity. This allows vendor SSO to complete entirely on the public vendor hostname while the administrator hostname remains private.