SSLCert

Prerequisites: AWS account with rights to create EC2, IAM roles, Secrets Manager secrets, key pairs, and security groups. An existing VPC/subnet with internet access. Your BYOL license token (for license activation). SSLCert ships as a prebuilt AMI, so you configure a readymade appliance rather than install from scratch. Minimum footprint: 1 EC2 instance, 1 IAM role, 1 secret. Plan 45 to 60 min.

1. Create the Secrets Manager secret Must be in the same region as the instance. Secrets Manager, then Store a new secret, then Other type of secret, then the Plaintext tab, entered as JSON: { "master_key": "<random>", "db_accounts_password": "<random>", "db_sslcert_password": "<random>" }

2. Create the IAM instance role IAM, then Roles, then Create role, trusted entity AWS service, then EC2. Attach an inline JSON policy granting readonly access to the secret above: Statement 1 (scoped to the secret ARN): GetResourcePolicy, GetSecretValue, DescribeSecret, ListSecretVersionIds. Statement 2 (must stay Resource: "*"): GetRandomPassword, ListSecrets, BatchGetSecretValue, which don't support resource-level restriction.

Name it e.g. "sslcert_ec2_instance_role", Create role. (Optional: create a .pem key pair if connecting via SSH key; chmod 600 it. Skip if using SSM or EC2 Instance Connect.)

3. Launch the EC2 instance from the AMI AWS Marketplace, search SSLCert, Subscribe, Configuration, Launch, then Launch through EC2.

Instance type: t3.medium (2 vCPU / 4 GiB min). Key pair: the one you created, or proceed without. Network: existing VPC plus subnet with internet access. Enable auto-assign public IP only if connecting over the internet. Security group: open port 22 (SSH), 80 (HTTP redirects to HTTPS), 443 (Web UI). Storage: 50 GiB min (100 GiB for heavy cert/log volume). Advanced details, IAM instance profile: select the role from step 2. Launch Instance.

On first boot the appliance probes IMDSv2; detecting AWS, it skips the manual network screens (the VPC already assigns an address) and pulls bootstrap secrets via the IAM role.

4. SSH in and run "Setup Applications" Once Running, connect as sysadm: SSH key: ssh -i key.pem sysadm@<appliance-ip>

The welcome TUI launches automatically and detects AWS. Have ready: SMTP host/port, email sender, appliance FQDN, admin email.