Troubleshooting

Start with the exact job/status message in SSLNexus. Then verify the dependency named by the failure: DNS, CA reachability, target management channel, Nginx/Apache configuration, firewall policy or application state.

Regenerate An Expired First-Setup URL

Before the first Administrator is created, run sudo ssl-nexus-admin setup-link locally. If the control-plane certificate is not ready, reach the setup URL through the SSH tunnel described in First access.

Cannot Complete First Access

Confirm the hostname configured during installation is correct and that you are using the short-lived setup URL. Public HTTP is not the normal admin path. If setup already completed, use the HTTPS administrator URL.

CA Connection Test Fails

Check connector credentials, DNS, outbound HTTPS, proxy/firewall policy and whether the CA permits API access from the SSLNexus server.

Linux Target Test Fails

Confirm DNS, SSH reachability, the generated automation key/account and required sudo permissions. Run the Linux SSH setup block again only after reviewing existing account/SSHD policy.

Windows Target Test Fails

Confirm WinRM, port 5985/5986, credentials and the required Windows administrative/Remote Management Users permissions.

This means the appliance management channel is healthy and the failure belongs to the target-bound CA profile. Check the CA endpoint, credentials/account identifiers and outbound network policy separately. Avoid changing the working appliance credential while diagnosing a CA-only failure.

Network Target Passes Test Connection But Test CA Fails

Confirm the API key/management API is reachable and that the configured certificate object, vsys/Shared scope and Panorama template information match the device design.

Palo Alto Networks

Confirm the account can create a vCenter API session and read the TLS certificate-management endpoint. During deployment, allow for the management API to disappear briefly while certificate activation restarts services.

VMware vCenter

Confirm the API identity can authenticate through the configured login provider and can read the selected Client SSL profile. Verify the partition, object name and profile name exactly match the BIG-IP configuration.

F5 BIG-IP

First separate management health from CA health. If Test connection fails, check DNS/routing, TCP 443, management-certificate trust and the appliance API credential. Do not change the CA settings until the native appliance management path is healthy.

Network Appliance Test Connection Fails

Apache HTTP-01 Returns 403 Or Redirect

Review the job's public preflight result. SSLNexus creates a temporary challenge webroot, adds explicit Apache access grants and suppresses common redirects during authorization. A remaining public 403/redirect commonly indicates another vhost, WAF/CDN, load balancer, SELinux/AppArmor policy or perimeter rule intercepting the request.

Deployment Fails After Issuance

Do not automatically request another certificate. Correct the target/application issue and retry deployment. Built-in Nginx/Apache work is not complete until the service reloads and the live SNI endpoint presents the deployed leaf fingerprint.

SSL Nexus Control-Plane Certificate Does Not Activate

Confirm the certificate name exactly matches the configured SSLNexus hostname. That name uses the local deployment path; it should not require a remote deployment target. Check nginx -t, the local sync service and the live certificate on 443.

Vendor Portal TLS Fails

Confirm the Vendor Portal hostname resolves to this SSLNexus server/public edge and that public TCP 80/443 reach Nginx. A CDN/proxy that returns unrelated edge addresses can fail the built-in DNS ownership check.

Renewal Does Not Run

Check the certificate expiry, renewal lead time, renewal mode, CA/target state and Settings > Automatic renewal schedule. Eligible automatic work is normally queued at the configured daily UTC checkpoint. Manual/retry jobs are not limited to that checkpoint.

Recovery Diagnostics

Run sudo ssl-nexus-admin recover doctor before changing protected state manually. Use --json for machine-readable output. Local Administrator access can be recovered with recover admin; licensing connectivity can be checked with recover licence.