FAQ

1. Which device types does Jelina support?

See the device overview.

2. Can a fleet contain multiple device types?

A fleet’s device type is guidance for operators; any device type can be added.

If fleet and device types differ, configured system, Kernel, and Jelinvisor update policies may be affected.

3. How do Production and Development modes differ?

Production mode blocks all ports except those used to communicate with JelinaCloud. Open required ports using the ports property in Compose.

Development mode follows Jelina conventions with fewer security restrictions and is suitable for development on the device.

4. Do existing services remain after moving a device or switching Releases?

A device can have only one Release installed at a time. When switching, it downloads the new Release, uninstalls the old services, and installs the new Release.

After moving to another fleet, it installs the Release specified by that fleet’s configuration.

5. Can JelinaCloud access my devices, source code, and program services?

Permission management prevents anyone without authorization, including Jelina administrators, from accessing your devices.

6. What does authorizing the Jelina team do?

The Jelina team has no fleet access by default. If you need help with a problem, temporarily authorize the team to access a specific fleet.

Access is restricted: the team cannot delete fleet information and has only some fleet administrator permissions, intended to help resolve issues quickly.

7. Why can I not remove myself from the member list?

Removing yourself would end your organization/fleet membership. To prevent accidental removal when selecting multiple members, this operation is not currently supported.

8. Why can I not delete system notifications?

These are important announcements published by Jelina administrators. Deletion is not currently supported to prevent important information from being missed or forgotten.

9. Can remote SSH use certificate authentication?

Yes. Configure device CA/principal rules, then have an administrator store the user certificate, matching private key, and required passphrase at fleet or device level and register and confirm host identity. On the connection page, select “OpenSSH user certificate” and the stored credential. The connection page has no upload feature, and device synchronization acknowledgment is not required.

This uses OpenSSH user certificates. RDP/VNC still use passwords; HTTPS and SSH host certificates cannot be used. See SSH key and certificate authentication.

10. Why does connection fail after a successful certificate import?

Check whether the target account allows certificates, credential usage permissions, certificate validity, device CA/principal configuration, and confirmed host identity. Device SSH CA/principal configuration remains your responsibility. Device-specific configuration prevents automatic fallback to fleet credentials.

See remote access management.

11. Does disabling a certificate immediately block direct SSH on the device?

Disabling or revoking a stored credential only prevents further platform use and does not synchronize automatically to devices. Revocation is irreversible and clears that entry’s encrypted private key without affecting independently stored entries. Device administrators must remove authorization or configure revocation rules to block direct SSH locally.

12. Why does a remote connection close while a long command runs?

The connection page shows idle and maximum durations. Valid input or remote output resets idle time, but a long task without input/output may be considered idle. Heartbeats do not extend application idle limits. An enabled maximum duration is not extended by activity.

Review the disconnect reason and reconnect manually. Contact the platform administrator for rule changes; fleet or device security policies cannot relax quotas or durations.

13. Does Waiting mean the invitation email was not delivered or the invitation expired?

Waiting means only that the invitation has not been successfully accepted or rejected. It does not indicate email delivery or reading. Opening the email or invitation page does not change status; account mismatches or failed acceptance can also leave it waiting.

Invitations currently have no fixed automatic expiry. An existing Waiting invitation does not expire solely with time. After acceptance, rejection, or deletion, the old link cannot be processed further. Administrators should delete invitations no longer needed.

14. Should an invalid invitation code always be resent?

First confirm that the signed-in account matches the invited email. Other accounts cannot accept or reject on the invitee’s behalf. Sign out of the wrong account or use a private window to sign in as the invitee, then reopen the original link. If unregistered, register with the invited email first.

If the account is correct, check whether the invitation was accepted, rejected, or deleted. An invalid code does not necessarily mean expiry, and resending does not necessarily resolve account mismatches.

15. Why is an organization invitation considered a duplicate after only a fleet invitation was sent?

Organization duplicate checks include pending invitations to the same email from fleets within that organization. Fleet checks cover only that fleet’s pending records. The checks are asymmetric, so organization and fleet invitations can also coexist.

Duplicate submission does not resend email or change the original role. To resend, correct an email, or change a pending role, delete the old invitation and create a new one. If both scopes are required, complete organization membership first, then send the fleet invitation.

16. Can an old organization invitation upgrade a role after accepting a fleet invitation?

Fleet invitations create organization Member membership when needed and preserve any existing organization role. Accepting an old organization invitation afterward attempts to create membership again and may conflict; it does not automatically upgrade Member to the originally invited role.

Once a user joins, change their organization role in member management and remove obsolete pending invitations. If only one fleet is needed, completing the fleet invitation is usually sufficient.

17. Why does access remain after deleting an invitation record?

Deleting a pending invitation invalidates its link. Deleting an accepted record only removes invitation history; it does not remove membership or revoke access. The record’s role is the role originally invited; current identity and roles are shown in the member list.

To remove access, remove the member or change roles, and check for access through other organization, fleet, or team roles.

18. Does SSH certificate login require cloud key synchronization or an agent upgrade?

No. Device administrators configure SSH public keys or CA/principal rules, while the platform stores and validates credentials and usage permissions. Devices do not fetch keys or report configuration versions/application status, and no agent upgrade is required solely for this feature. The device SSH service must support the authentication method.

Before the first connection, an administrator must manually register, verify, and confirm host public keys on the device page. See remote access management.

19. Must every user certificate and private key be placed on the device?

User certificates generally do not need individual installation. The device trusts an issuing CA public key and allowed principals; clients present user certificates during connection. User private keys are stored encrypted in the platform for authorized connections, and CA private keys remain with issuers. Neither is copied to devices as trust configuration. A bare CA public key in authorized_keys is insufficient; CA authorization requires cert-authority and correct principal restrictions.

See examples in SSH key and certificate authentication.

20. Do unavailable device credentials trigger fallback to fleet credentials?

No. For the same account and authentication method, device configuration takes precedence. Expiry, disabling, revocation, or lack of permission never triggers automatic fallback. Fleet credentials apply only when no matching device configuration exists, without an inheritance switch. Deleting the last device entry may restore inheritance and requires explicit administrator confirmation.

21. Does the platform renew user certificates automatically?

No. Request a new certificate from your CA administrator and use “Update key/certificate” in fleet or device key management. The platform does not accept CA private keys, issue certificates, or renew them automatically. The connection page only selects stored user credentials.

22. How can I generate supported SSH certificates on Windows or Linux?

Both systems can use OpenSSH ssh-keygen to generate Ed25519 or RSA user keys. Your CA administrator then uses ssh-keygen -s to issue an OpenSSH user certificate with an explicit validity period and nonempty principals. Windows uses PowerShell and OpenSSH Client; Linux uses OpenSSH client tools. These are not X.509 certificates generated with OpenSSL.

Ordinary key authentication requires only user keys; certificate authentication also needs a user certificate and device CA trust. For Windows/Linux generation commands, file destinations, JelinaOS (Linux) device configuration, and cloud uploads, see SSH key and certificate authentication.