Skip to main content

​
Confirm System Requisites

Before installation, confirm the platform choice and pilot capacity baseline:
  • Preferred path: SafeSquid Appliance Builder for clean appliance-style deployment
  • Alternate path: Linux package deployment when platform standards require it
  • Minimum pilot hardware: 4 CPU cores, 4 GB RAM, 160 GB storage
  • Recommended production starting point: 8 CPU cores and 8 GB RAM
For full platform prerequisites, sizing decisions, and network dependencies, use Install Prerequisites and Deployment Planning.

​
Prepare A Controlled Pilot

Before onboarding users, confirm:
  • A deployment owner and change record are defined
  • The activation_key storage location is approved and access-controlled
  • Topology, sizing, firewall, DNS, NTP, and rollback decisions are documented
  • A Root CA rollout path exists for managed endpoints
  • Log retention and reporting ownership are assigned
Use Deployment Planning and Install Prerequisites to complete these controls before installation.
1

Register and secure the activation key

Create an account in the SafeSquid Self-Service Portal and download the activation_key.Confirm the key is stored in approved secure storage with controlled access.If the file is missing or renamed, re-download it before activation.
2

Install the selected platform

Choose the approved install path in Install SafeSquid, then complete that platform guide.Confirm SafeSquid service health and listener readiness before client routing.If platform ownership or baseline requirements are unresolved, stop rollout and return to deployment planning.
3

Confirm management portal access path

Open the Configuration Portal from a proxied pilot browser at http://safesquid.cfg/.If the proxied path is unavailable during controlled setup, use direct administrator access at https://SAFESQUID-SERVER-IP:8443/ from an approved management network.If neither path works, pause activation and resolve listener, proxy, or administrator network controls first.
4

Route one pilot client through SafeSquid

Use Connect Your Client to configure explicit proxy, PAC, system-wide proxy, or managed rollout.Confirm one pilot request appears in /var/log/safesquid/access/extended.log.If traffic bypasses the proxy, verify proxy settings, PAC output, and bypass rules.
5

Activate and apply baseline controls

Complete Activate Your License, then run Configure Web Security Policies.Confirm a test request produces the expected allow, block, inspect, or log action.If policy outcome differs from design, check rule order, identity attribution, and bypass entries.

​
Prove Production Readiness

Before expanding beyond pilot users, collect and attach evidence to the deployment record:
  • Activation proof: license details visible in the Configuration Portal
  • Routing proof: first pilot transaction in /var/log/safesquid/access/extended.log
  • HTTPS trust proof: pilot endpoint trusts the SafeSquid Root CA and browses without trust warnings
  • Policy proof: at least one expected allow or block event mapped to a known policy rule
  • Audit proof: report or log export includes user, source, URL, action, and timestamp
Use Verify Your Setup for the full production sign-off workflow.

​
Immediate Next Controls

After pilot evidence is stable, apply these two controls first:
  1. HTTPS inspection with trusted Root CA rollout for managed endpoints.
  2. Identity integration with Active Directory or OpenLDAP for accountable policy enforcement.
Use Configure Web Security Policies to sequence these controls without breaking pilot stability.

​
Troubleshoot First Pilot

If a pilot check fails, use the matching symptom below and capture corrected evidence before expanding rollout.
The pilot client is not routing through SafeSquid, so policy and audit controls are not being enforced.Likely cause: Browser or host proxy settings, PAC output, or bypass rules are directing traffic around SafeSquid.Fix:
  1. Reapply the selected routing method using Connect Your Client.
  2. Retest with a single pilot request.
  3. Confirm the client is pointing to the approved proxy IP and port.
  4. Remove unapproved bypass entries from pilot settings.
Verify: /var/log/safesquid/access/extended.log records a new pilot entry with source, destination, action, and timestamp.
Operators cannot complete activation and policy setup when http://safesquid.cfg/ is unreachable through the proxy path.Likely cause: Pilot browser bypasses the proxy or SafeSquid listener access is blocked.Fix:
  1. Follow Access the Interface from a proxied pilot browser.
  2. Confirm the pilot browser proxy settings are active.
  3. Validate SafeSquid listener state on the gateway.
  4. Retry http://safesquid.cfg/ from the same pilot path.
  5. If needed, test direct management fallback from an approved administrator network at https://SAFESQUID-SERVER-IP:8443/.
Verify: http://safesquid.cfg/ or approved direct fallback https://SAFESQUID-SERVER-IP:8443/ allows Configuration Portal access.
HTTPS controls cannot be trusted in production when endpoints do not trust the SafeSquid Root CA or inspection scope is too broad for pilot stage.Likely cause: Root CA deployment is incomplete, or inspection policy includes destinations not ready for decryption.Fix:
  1. Complete Root CA rollout for the pilot endpoint.
  2. Keep inspection scope limited to approved pilot destinations.
  3. Re-run the HTTPS pilot test from the managed client.
  4. Review SSL policy scope in Configure Web Security Policies.
Verify: HTTPS pilot sessions complete without trust warnings and logs show expected policy action.
Missing user, action, or timestamp details reduce incident response quality and delay audit acceptance.Likely cause: Identity mapping, retention policy, or reporting export configuration is incomplete.Fix:
  1. Use Verify Your Setup to confirm log and evidence requirements.
  2. Enable identity-aware policy attribution for pilot users.
  3. Configure log retention and export path before expansion.
  4. Re-run one controlled pilot request and capture output.
Verify: Exported evidence includes user, source, URL, action, and timestamp for the new pilot request.

​
Next steps

Related topics

Application EcosystemPolicy Management ConsoleFiles and FoldersSafeSquid Appliance Builder