Manage SSLNexus From The Shell

The web interface remains the normal control plane for certificate lifecycle work. The shell is useful for host health, diagnostics, recovery, backup/restore, initial-access recovery and TLS/frontend repair when browser access is unavailable.

Quick Health Check

sudo systemctl status ssl-nexus
curl -fsS http://127.0.0.1:8080/healthz
sudo ssl-nexus-admin preflight
sudo nginx -t
sudo journalctl -u ssl-nexus -n 100 --no-pager

A healthy local backend returns ok from /healthz. preflight checks the configured database, Ansible/SSH/Nginx/OpenSSL dependencies, protected files, PostgreSQL tools and schema when PostgreSQL is active, Windows automation dependencies when present, Nginx syntax, local write access and other runtime prerequisites.

Service Control

sudo systemctl status ssl-nexus
sudo systemctl start ssl-nexus
sudo systemctl stop ssl-nexus
sudo systemctl restart ssl-nexus
sudo systemctl enable --now ssl-nexus

The main unit runs /usr/bin/ssl-nexus-server. Normal certificate jobs, scheduled renewal work, API/UI traffic and background control-plane operations depend on this service.

Logs And Runtime Diagnostics

sudo journalctl -u ssl-nexus -n 100 --no-pager
sudo journalctl -u ssl-nexus --since today
sudo journalctl -u ssl-nexus -f

Use the journal for startup/runtime failures and the web Activity & Audit view for user/workflow audit history.

Preflight

sudo ssl-nexus-admin preflight
sudo ssl-nexus-admin preflight --json

Use the normal form for an operator-readable report or --json when collecting results in automation or support tooling. A failed required dependency causes a failed preflight result.

Regenerate A First-Access Setup Link

sudo ssl-nexus-admin setup-link

Creates a new short-lived setup URL when the installation does not yet have a configured local Administrator. The command stores a bootstrap token in /etc/ssl-nexus/bootstrap.env, gives it a 30-minute expiry, restarts the SSLNexus service and prints the setup URL. It refuses to run after an Administrator password already exists.

Backup And Restore

Create A Backup

sudo ssl-nexus-admin backup
sudo ssl-nexus-admin backup --output /secure/path/ssl-nexus-backup.tar.gz
sudo ssl-nexus-admin backup -o /secure/path/ssl-nexus-backup.tar.gz

Without --output, the archive is written under /var/backups/ssl-nexus/. The backup contains protected configuration and persistent SSLNexus state; PostgreSQL-backed installations also include a PostgreSQL dump. The command temporarily coordinates the main service/vendor ACL watcher to obtain a consistent backup and restores their previous running state afterwards.

Restore A Backup

sudo ssl-nexus-admin restore /path/to/ssl-nexus-backup.tar.gz

Restore validates the archive first, creates a new pre-restore rollback backup, replaces application state/database content, repairs ownership and restores the previous service state. Keep the rollback archive until the restored installation has been fully verified.

Administrative Recovery

Recovery Doctor

sudo ssl-nexus-admin recover doctor
sudo ssl-nexus-admin recover doctor --json

Checks configuration, application/database state, local Administrator availability, protected secret files, target encryption material, deployment-target credential readability, local service health and recovery prerequisites.

Reset A Local Administrator

sudo ssl-nexus-admin recover admin --email [email protected] --generate
printf '%s\n' 'A-new-strong-password' | sudo ssl-nexus-admin recover admin --email [email protected] --password-stdin

--generate creates and displays a replacement password once. --password-stdin avoids placing the new password in shell history. The account is re-enabled, existing sessions for that Administrator are revoked and the recovery action is audited.

Check The Licence Authority

sudo ssl-nexus-admin recover licence
# US-spelling alias is also accepted:
sudo ssl-nexus-admin recover license

Performs an immediate authority check and prints the installation ID, licence ID, tier, current mode and expiry. This is useful when the UI cannot establish whether entitlement state is stale or the authority connection itself is failing.

Control-Plane TLS

sudo ssl-nexus-admin ui-cert \
  --domain nexus.example.org \
  --email [email protected]

# Test against Let's Encrypt staging first:
sudo ssl-nexus-admin ui-cert \
  --domain nexus.example.org \
  --email [email protected] \
  --staging

The command uses Let's Encrypt HTTP-01, stores the resulting UI certificate below /etc/ssl-nexus/tls/, updates the managed Nginx frontend, validates with nginx -t and reloads Nginx. Use --staging while validating DNS/firewall reachability to avoid production CA rate limits.

Vendor Portal TLS

sudo ssl-nexus-admin vendor-cert
sudo ssl-nexus-admin vendor-cert --config /etc/ssl-nexus/config.json
sudo ssl-nexus-admin vendor-cert --config /etc/ssl-nexus/config.json --staging
sudo ssl-nexus-admin vendor-cert --config /etc/ssl-nexus/config.json --if-configured

This command applies only to a dedicated Vendor Portal hostname. It validates the configured public URL/backend, confirms DNS resolves to the SSLNexus server, provisions or renews the Let's Encrypt certificate, tests Nginx and reloads it. --if-configured exits successfully when a dedicated public Vendor Portal endpoint is not configured; the packaged renewal service uses this mode.

Recover The SSLNexus Nginx Frontend

sudo /usr/libexec/ssl-nexus/recover-nginx-config --list
sudo /usr/libexec/ssl-nexus/recover-nginx-config --restore-latest
sudo /usr/libexec/ssl-nexus/recover-nginx-config --generate

--list shows the current frontend plus recoverable package-upgrade snapshots. --restore-latest intentionally replaces the current frontend from the newest durable snapshot after first saving the current files. --generate creates a fresh standard frontend only when no recoverable snapshot is available. The helper always validates Nginx before reloading it.

Installed Systemd Units

sudo systemctl status ssl-nexus.service
sudo systemctl status ssl-nexus-backup-agent.socket
sudo systemctl status ssl-nexus-local-ui-sync.path
sudo systemctl status ssl-nexus-vendor-acl.path
sudo systemctl status ssl-nexus-vendor-cert.timer
sudo systemctl list-timers ssl-nexus-vendor-cert.timer

Install Or Upgrade From The Shell

SSLNexus is distributed as binary release packages. Install or upgrade using the package supplied for your operating-system family.

Binary Packages

# Debian / Ubuntu
sudo apt install ./ssl-nexus-client_<version>_amd64.deb

# RHEL / Rocky / AlmaLinux
sudo dnf install ./ssl-nexus-client-<version>-1.x86_64.rpm

Advanced And Compatibility Commands

The following commands exist in the installed command surface but are not normal day-to-day administration interfaces. Use them only when a documented recovery/migration procedure specifically calls for them.

Legacy Vendor-State Bootstrap

sudo ssl-nexus-admin \
  --organisation "Example Organisation" \
  --vendor "Example Vendor" \
  --domain example.org \
  --cidr 203.0.113.0/24 \
  --vendor-email [email protected] \
  --admin-email [email protected] \
  --renewal-before-days 30

The command refuses to overwrite an existing organisation state and prints generated API keys once. --state can select an explicit offline JSON state file and --require-approval remains a legacy policy flag. Normal R15 vendor administration should use the web control plane.

Low-Level Issuance Engine

SSL_NEXUS_CONFIG=/etc/ssl-nexus/config.json ssl-nexus < request.json

/usr/bin/ssl-nexus accepts exactly one JSON issue request on standard input and writes a JSON result. It is a low-level compatibility/engine binary rather than a replacement for the R15 control-plane API and should not be used to bypass policy, deployment or audit workflows.

Service-Owned Commands — Do Not Run Manually

Useful Host Paths