Skip to main content
This guide covers the very first boot of a newly deployed appliance: enrolling SSH access, creating the first account, and setting the network address. It is for the person who deployed the OVA.

​
What you see on the VM console

On first boot the appliance prints an access banner on the hypervisor console (vSphere/Workstation Console tab):
  • Web UI — the address to open in a browser.
  • IP address — the current address, shown live at every login prompt (it stays accurate through DHCP changes).
  • One-time console password for the enclaveadmin console account (you must change it at first login).
  • First-signup code — a single-use entitlement code that authorises creating the first account in the web UI.
Only someone with hypervisor console access can read these values.

​
Step 1 — Enrol an SSH public key (required)

For security, the appliance ships with no SSH access — nothing to steal, and no vendor-held key. Before you can create the first account, the web UI requires you to enrol your own SSH public key. Your private key never leaves your machine.
1

Generate a key pair (if you don't have one)

  • OpenSSH: ssh-keygen -t ed25519 -C you@company — then copy the contents of the .pub file.
  • PuTTYgen: generate a key, then copy the “Public key for pasting into OpenSSH authorized_keys” box, or use Save public key and paste that file.
Supported types: RSA (≥ 2048-bit), ECDSA (P-256/384/521), Ed25519. Both the OpenSSH one-line format and the PuTTY/SSH2 (---- BEGIN SSH2 PUBLIC KEY ----) format are accepted.
2

Open the appliance and paste the key

Browse to https://<appliance-ip> (accept the self-signed warning for now). On the Appliance Setup screen, paste your public key and select Enrol key & continue.
3

SSH is enabled

The appliance installs your key for the enclaveadmin account and enables key-only SSH (password authentication stays off). You can now ssh enclaveadmin@<appliance-ip> to reach the restricted console remotely.
Enrolment is a one-time gate: once the first account exists it is locked, and SSH keys are managed from the console (ssh-add-key) thereafter.

​
Step 2 — Create the first account

After the key is enrolled, the signup form appears. Create the first organisation account using the first-signup code from the console banner. This account is the appliance owner.

​
Step 3 — Set the network address

By default the appliance uses DHCP and is reachable at the address it leases. To assign a fixed address you have three options:
  • At deploy time (vApp properties). vCenter/ESXi shows a Customize template step with fields for IPv4 Address (CIDR), Gateway, DNS, NTP, and Hostname. Leave blank for DHCP. These are applied at first boot.
  • From the web UI. Admin → Network & TLS lets the owner set the hostname/FQDN (see Web TLS certificate & hostname).
  • From the console. network set <iface> <ip/cidr> <gateway> <dns> (list interfaces with network show).
A stable FQDN is strongly recommended for production: emailed links (invitations, password resets) embed the appliance address, and a trusted TLS certificate requires a hostname. Front the appliance with a DNS name before inviting users.

​
Step 4 — Time synchronisation

Accurate time (UTC) is required for KMS, TLS, and licence operations. Set an NTP server at deploy time (vApp NTP field) or on the console with time ntp <server>. See the main appliance guide.

​
Next steps