Operator Reference
A concise production reference. For implementation/source details use the packaged technical guide; this page focuses on operational facts administrators need while running SSL Nexus.
Host Baseline
Production installations should normally use a dedicated Linux VM/server. See System requirements for sizing, DNS, ports and storage. Current packages target amd64/x86_64 Linux with systemd.
Installation Packages
| Platform | Package |
|---|---|
| Debian / Ubuntu | ssl-nexus-client_<version>_amd64.deb |
| RHEL / Rocky / AlmaLinux | ssl-nexus-client-<version>-1.x86_64.rpm |
Control-Plane Listeners
| Listener | Purpose |
|---|---|
127.0.0.1:8080 | Local SSL Nexus application backend |
| 80/443 via Nginx | Control-plane hostname / ACME HTTP-01 / HTTPS |
127.0.0.1:8081 normally | Optional Enterprise vendor-only backend |
Target Connections
In segmented environments, place SSLNexus in a management/automation VLAN or security zone and allow these connections from SSLNexus to approved target addresses. Do not create broad reciprocal access from managed VLANs back to the control plane.
| Target Class | Direction | Protocol/API | Typical Port |
|---|---|---|---|
| Linux | SSL Nexus → target | SSH | 22 |
| Windows | SSL Nexus → target | WinRM + NTLM | 5985 / 5986 |
| Palo Alto Networks | SSL Nexus → target | PAN-OS XML API over HTTPS | 443 |
| F5 BIG-IP | SSL Nexus → target | iControl REST over HTTPS | 443 |
| VMware vCenter | SSL Nexus → target | vCenter REST API over HTTPS | 443 |
Built-In Application Catalogue
The current first-party deployment catalogue is Nginx, Apache, IIS, PaperCut, SAP BI Launch Pad, IWMC, Palo Alto Networks PAN-OS/Panorama, F5 BIG-IP and VMware vCenter. Custom plugins can target Linux or Windows. Applications not registered in the catalogue are not advertised as built-in integrations.
Operational Roles
| Role | Operational Scope |
|---|---|
| Administrator | Full organisation/product administration. |
| Operator | General certificate and deployment operations. |
| Network Operator | Read/write network-appliance targets and certificates bound to network targets only. |
| Read-only | Visibility without configuration/lifecycle changes. |
Health Checks
Test connection validates the target management path. Test CA independently validates the target-bound CA profile. Target credentials and CA credentials are stored separately and failures are reported separately.
Dependencies
The control plane invokes Ansible as a separate provisioning process for applicable deployment workflows. The package declares Nginx, Python, Ansible Core, OpenSSH client, OpenSSL, CA certificates, curl and util-linux. Windows deployment additionally requires the supported Windows collections and pywinrm. Package activation does not silently fetch Galaxy/PyPI content from public repositories.
Renewal Scheduling
Certificate lead time determines eligibility. renewal_check_time_utc controls the daily automatic-renewal check time. The worker continues processing manual work and retries independently of that daily check.
Local Control-Plane TLS
The hostname stored in /etc/ssl-nexus/server-hostname identifies the local control plane. Certificates for that exact name bypass remote target discovery and are deployed to the local SSL Nexus Nginx frontend.
Vendor Portal TLS
The Enterprise dedicated Vendor Portal validates its public DNS name before activation and uses Let's Encrypt for the public vendor certificate. The vendor backend remains loopback-only.
Internal PKI Endpoints
When the effective Internal PKI entitlement is enabled, SSLNexus exposes https://<ssl-nexus-hostname>/acme/internal/directory. The private root is /acme/internal/ca.pem, the signed DER CRL is /acme/internal/crl, and a PEM CRL is /acme/internal/crl.pem. R14 requires EAB by default for new account registration and applies enrollment DNS/source/key/validity/account policy before issuance. See Internal PKI and private ACME.
Package Lifecycle
Upgrades preserve persistent state and create a recovery snapshot before activation. A new package must pass health/version, Nginx and production-preflight checks. Package removal does not automatically delete /etc/ssl-nexus or /var/lib/ssl-nexus.
Support Information
When requesting support, provide the SSL Nexus version, Linux family, affected target/feature, job ID and exact error text. Do not send passwords, private keys or CA secrets through ordinary support channels.