Getting Started

System Requirements

Production Sizing And Host Requirements

Use these values as planning baselines for the SSLNexus control-plane server. Actual utilisation depends on certificate volume, job concurrency, discovery, reporting, backups and Vendor Portal traffic.

Production placement
SSLNexus can coexist with other applications, but a dedicated Linux server or VM is strongly recommended. A clean host avoids Nginx/port conflicts, resource contention and upgrade coupling with unrelated applications.

Server Sizing

Profile	Cpu	Memory	Storage	Use
Minimum	2 vCPU	2 GB	20 GB SSD	Evaluation, lab use and small estates with light automation
Recommended minimum	4 vCPU	4 GB	40 GB SSD	Normal production use with routine Linux/Windows deployment and reporting
Recommended production / scalable	8 vCPU	16 GB	100 GB+ SSD	Larger estates, concurrent jobs, discovery, Vendor Portal and internal ACME

Use SSD-backed storage and leave additional space for backups, audit/report history and future certificate state. The larger profile is recommended when SSLNexus is a shared institutional service or will run multiple automation workloads at the same time.

Supported Host Model

64-bit Linux using systemd.
Debian/Ubuntu with the native .deb package.
RHEL-compatible systems, including Rocky Linux and AlmaLinux, with the native .rpm package.
Current customer packages target amd64/x86_64.

SSLNexus itself is not installed on Windows. Windows servers are managed remotely through WinRM when the licence tier/application supports Windows deployment.

Local Dependencies

The package declares the normal control-plane dependencies it needs, including Nginx, Python 3, Ansible Core, OpenSSH client tools, OpenSSL, CA certificates, curl and util-linux. If a required package is already present, the package manager leaves it in place.

Windows automation additionally needs the supported Ansible Windows collections and pywinrm. Production activation does not silently download Galaxy/PyPI content from public repositories; provide approved versions through your normal repository and verify them with ssl-nexus-admin preflight.

DNS And Hostname

First installation requires a fully qualified DNS hostname such as nexus.example.org. Do not use an IP address. SSLNexus stores this hostname as the identity of the local control plane.

The administration hostname may be internal-only. Public Let's Encrypt issuance for the control-plane certificate requires the hostname to resolve to the reachable server/public edge and TCP 80/443 to reach Nginx.

The Enterprise Vendor Portal always uses Let's Encrypt for its dedicated public hostname, so public DNS and TCP 80/443 are required for that endpoint.

Network Requirements

In segmented environments, place SSLNexus in a dedicated management or automation VLAN/security zone. Give that zone routed, firewall-controlled access only to the systems and services SSLNexus must manage. Do not flatten VLAN boundaries or create broad any-to-any rules: define source, destination and port explicitly.

Normal deployment direction: SSLNexus initiates the management connection to Linux, Windows and network-appliance targets. Managed server/application VLANs do not need general inbound access to the SSLNexus control plane. Inbound access should be limited to trusted administrators and features that intentionally accept client connections, such as Internal PKI/ACME or an enabled Vendor Portal.

Purpose	Direction	Typical Ports
Administrator HTTPS	Inbound to SSL Nexus from trusted admin networks	443
Public ACME HTTP-01 for SSL Nexus-hosted endpoints	Inbound to SSL Nexus when used	80
Internal PKI / private ACME clients	Inbound to SSL Nexus when enabled	443
Vendor Portal	Inbound to SSL Nexus when enabled	80 / 443
Linux target automation	Outbound from SSL Nexus	22
Windows target automation	Outbound from SSL Nexus	5985 / 5986
Network-appliance management	Outbound from SSL Nexus	Normally 443
Live TLS verification	Outbound from SSL Nexus	Normally 443
Licensing, CA, SSO and API integrations	Outbound from SSL Nexus	Normally 443
DNS	From SSL Nexus to approved resolvers	53 TCP/UDP
Time synchronisation	From SSL Nexus to approved time sources	123 UDP

Keep the application backends 127.0.0.1:8080 (control plane) and normally 127.0.0.1:8081 (separate Vendor Portal) on loopback. Do not expose them directly.

Time And Name Services

Maintain reliable DNS and accurate system time using the organisation's normal DNS and NTP/chrony services. ACME, certificate validation, authentication tokens, audit timestamps and licence checks depend on both.

State And Backup Paths

/etc/ssl-nexus
/var/lib/ssl-nexus
/var/lib/ssl-nexus-admin
/var/backups/ssl-nexus

Place these paths on reliable persistent storage and include them in operational monitoring. Keep protected SSLNexus backups outside transient storage and, where practical, transfer recovery archives to approved off-host storage.

Running With Other Applications

Coexistence is supported when ports, Nginx ownership, dependencies and security policy do not conflict. For optimised performance and simpler support, use a clean dedicated host. If you deliberately share a server, review existing listeners on ports 80/443, Nginx includes, SELinux/AppArmor rules, systemd unit names, disk growth and resource utilisation before installation.