4.4. Subscription EE

suSSHi Chef is Free/Libre Open Source Software (FLOSS) and runs perfectly well without a subscription. A suSSHi Chef Enterprise Edition subscription adds the Enterprise features, such as Target Fusions, suSSHi Proxy, suSSHi Bastion, Audit Log Encryption and Dynamic One-Time Passwords.

The state of your subscription is shown under Dashboard > Subscription. The top navigation bar carries a short summary as well, for example No Subscription, Subscription expires soon or Subscription expired.

There are two ways to activate a subscription:

Subscription Key: The regular way. You receive the key with your order and enter it once in the web interface. The installation then fetches its subscription itself and renews it automatically.
Subscription Token File: For air-gapped installations without an outbound internet connection. suSSHi support issues a signed token file that you mount into the container.

Note

Use one or the other, not both. As soon as a subscription key is stored, suSSHi Chef obtains its subscription online and a mounted token file is no longer read.

Every subscription is issued for exactly one installation and is bound to its Installation ID. A subscription cannot be moved to a second installation.

4.4.1. Activation with a Subscription Key

Log in to suSSHi Chef as an administrator and open Dashboard > Subscription.
Enter the subscription key you received with your subscription and press Activate Online Subscription.

suSSHi Chef contacts the suSSHi subscription service, verifies the answer and stores the subscription. On success the page shows your subscription details and the Enterprise features become available immediately.

The subscription key stays stored in suSSHi Chef and is reused for every renewal. Keep it in a safe place anyway — you need it again after a reinstallation.

4.4.1.1. Automatic Renewal

Once a subscription key is configured, suSSHi Chef renews the subscription on its own:

every time the suSSHi Chef container starts, and
once every night.

You can also trigger an attempt at any time with Refresh Subscription on the subscription page.

The subscription page then shows Subscription Source: Fetched online, renewed automatically together with the Last Contact timestamp.

4.4.1.2. Network Requirements

The suSSHi Chef container needs to reach the suSSHi subscription service at https://concierge.susshi.io over HTTPS (TCP port 443). Please allow this outbound connection in your firewall.

If your network requires an HTTP proxy for outbound connections, pass the usual HTTPS_PROXY and NO_PROXY environment variables to the suSSHi Chef container:

compose.yaml (add)

  susshi-chef:
    ...
    environment:
      - HTTPS_PROXY=http://proxy.example.org:3128
      - NO_PROXY=localhost,127.0.0.1,susshi-db

Nothing but the subscription is exchanged. If the service cannot be reached, suSSHi Chef keeps running on the subscription it already holds — Enterprise features are never switched off because of a failed connection.

4.4.2. Air-gapped Installations

Installations without an outbound internet connection receive a signed subscription token file instead of a subscription key.

Open Dashboard > Subscription and note the Installation ID shown there.
Ask suSSHi support for a subscription token, quoting that Installation ID. You will receive a signed token file (subscription.token).
Save the file on the container host, for example as $BASEDIR/susshi-chef/subscription.token, and mount it into the suSSHi Chef container as a Docker secret:
compose.yaml (add)
```
  susshi-chef:
    ...
    secrets:
      - subscription.token

secrets:
  subscription.token:
    file: ${BASEDIR}/susshi-chef/subscription.token
```
Alternatively the file can be mounted directly as /subscription.token inside the container.
Apply the change:
```
$ docker compose up -d
```

suSSHi Chef reads and verifies the token when the container starts. Refresh Subscription on the subscription page reads the mounted file again without a restart.

Warning

A token file does not renew itself. Before the subscription expires, request a new token from suSSHi support and replace the file. suSSHi Chef starts warning 30 days ahead of the expiry date.

4.4.3. Subscription Details

Dashboard > Subscription lists everything the subscription contains:

Entry	Description
Subscription for Company	The company the subscription was issued for.
User	The contact the subscription was issued to.
Installation ID	The identifier of this installation. Quote it in every support request concerning your subscription.
Valid not before / Valid not after	The period the subscription is valid for. A date that has passed or is approaching is highlighted.
Last Refresh	When the subscription was last installed or renewed.
Subscription Source / Last Contact	Only shown when a subscription key is configured: confirmation that the subscription is fetched online, and when the service was last reached.
Gateway Users / Targets	The number of Gateway Users and Targets included in your subscription, followed by the number currently configured.
Features	The Enterprise features this subscription enables.

4.4.4. Warnings and Troubleshooting

suSSHi Chef shows a warning in the web interface when something needs your attention.

With a subscription key, the subscription is renewed continuously, so a warning appears only when a renewal did not happen within the last three days before expiry, or when the subscription service has not been reached for three days. With a mounted token file, the warning appears 30 days before the expiry date, because replacing the file is a manual task.

Status	Meaning	What to do
Online service unreachable	The installation could not reach the subscription service. It keeps running on the subscription it already holds.	Check the outbound connection and any proxy configuration, then press Refresh Subscription.
Last Contact: Not yet	The subscription service has never been reached with this key.	Verify the subscription key and the outbound connection.
Subscription key refused	The key is not valid for this installation. The current subscription keeps working until it expires, but it will not renew.	Request a corrected subscription key from suSSHi support and enter it on the subscription page.
Withdrawn	The subscription was withdrawn by Wasabi Elements GmbH. Enterprise features are disabled.	Contact suSSHi support.
Subscription expired	The validity period has ended and Enterprise features are disabled.	Renew your subscription. Air-gapped installations need a new token file.

Note

Without an active subscription suSSHi Chef continues to run with all FLOSS features. Only the Enterprise features are disabled.

Do you need a subscription, or would you like to change your plan? Have a look at our Subscription Plans.