You just finished lattice-install. The rest of day one is a browser on your Windows PC, not more SSH.
Windows/SSH survival: windows-admin. Next: first-subnet.
Just show me the steps — URL, token, and tokens page at the bottom.
1. Open the console
In Edge or Chrome:
https://10.0.0.11
Use the VM’s address (paid HA: the VIP). Not http://127.0.0.1:8080 — that port is only on the VM itself.
The certificate warning is expected
Lattice ships a self-signed certificate so HTTPS works on day one. Windows will say the site is unsafe. That is not a phishing page you typed wrong; it is a new VM without your org’s CA yet.
- Edge/Chrome: Advanced → Continue to the site.
- Replace
/etc/lattice/tls/server.crtandserver.key(HA:haproxy.pem) later with a cert from your internal CA or Let’s Encrypt. LatticeDDI does not sell certificates. install-prerequisites §8.
Bookmark the https:// URL. HTTP on port 80 only serves /readyz and then redirects.
2. The “password” is a token
Lattice does not create Administrator / Password1. The installer prints a string that starts with lattice_live_… once, and writes it on the VM:
/etc/lattice/bootstrap.token
Closing the browser tab does not revoke it. If you did not copy the printout, SSH (or WinSCP) and read the file:
sudo cat /etc/lattice/bootstrap.token
Paste the whole line into the console sign-in box. Spaces and a missing lattice_live_ prefix are the usual failures.
Treat it like a password. Do not put it in a ticket, a screenshot of Overview, or Slack. Mint a second admin token in More → Tokens and store that in your password manager; you can revoke the bootstrap later.
If the box says bootstrap / create first admin
The installer already wrote the first token to /etc/lattice/bootstrap.token. Off the VM you cannot mint that token in the browser. SSH and sudo cat the file.
SSO (Entra / Okta / AD FS)
Optional, later. Console Settings OIDC. That logs operators in. It is not AD DNS and not LDAP bind. Vendor setup: Microsoft Entra ID (OIDC), Okta, AD FS. What Lattice expects: integrations.
3. What you should see
After paste: Overview. Heartbeats, Work tile, license cap. Community is a complete single node. Three-node HA is paid and a later install if you need failover.
Help (top right) is the in-console version of first subnet, first lease, and upgrade. Public docs: latticeddi.com/docs.
4. Mint people tokens before you share the bootstrap
More → Tokens (admin):
| Role | For |
|---|---|
admin | Installer, DNS adapters, webhooks, license, tokens |
operator | Helpdesk: reservations, force-release, Work Replay |
readonly | Look, don’t click |
The secret is shown once. Same as the bootstrap token. An operator does not need SSH.
5. Checklist
-
https://<vm-or-vip>from your PC, accepted the cert warning - Signed in with
lattice_live_… - Extra admin token in the password manager
- Operator token for helpdesk if someone else takes tickets
- Next: first-subnet — a prefix is not a Microsoft scope
Just the steps
https://10.0.0.11
(Paid HA: the VIP.) Accept the self-signed warning (Advanced → Continue). Token:
sudo cat /etc/lattice/bootstrap.token
Paste the whole lattice_live_… line. Then More → Tokens: mint an admin for the password manager and an operator for helpdesk. Closing the tab does not revoke the bootstrap.