Dashboard reference
Every screen in the aethercert dashboard and every setting on it, in sidebar order - Build, Manage, Monitoring, MSP, Help and Settings.
This page documents every screen and every setting. It is a reference, not a walkthrough - if you are setting aethercert up for the first time, start with the Quickstart.
Plans gate settings, not screens
You can always see every control. Plan-restricted ones are disabled with an upgrade hint rather than hidden, and the server enforces the same limits independently of what the browser shows. The matrix is in Plans and limits.
Dashboard
The landing page. Counters for the fleet, a chart of certificate expiries covering a year back and a year forward, and a list of the certificates closest to expiring. Certificates are flagged urgent within 14 days and soon within 30. A certificate already past its not-after counts as needing attention whatever its auto-renew setting says - it did not renew itself in time.
Build
Build > Certificate Job
The main form. It ties an identity, an authority, a deploy target and a schedule together and queues the issue job. Six sections.
Certificate
| Setting | Values | What it does |
|---|---|---|
| Domain | optional | Pick a verified domain to enable DNS-01 and enter hostnames as just the label - the domain is appended, so you cannot produce a hostname DNS-01 could not cover. Leave empty for HTTP-01, TLS-ALPN-01 or an internal authority. |
| Certificate authority | Which authority issues this certificate. Free is limited to Let's Encrypt; an internal domain requires an Internal CA (REST), and the form says so inline if the pair does not fit. | |
| Certificate template | Internal CA (REST) with a paired connector | Which AD CS template to issue against. Connector default uses the one the connector was installed with. Inline hints warn about client-auth and subject-from-AD templates. |
| Challenge type | DNS-01 (default), HTTP-01, TLS-ALPN-01 | How control of the name is proven. DNS-01 needs a domain with a DNS provider configured. |
| Common name | The primary hostname. With a domain selected, enter only the label. | |
| Subject alternative names | 0..n | Additional hostnames on the same certificate. |
| PSW product | PSW Group only | Which product to order. The list is fetched live from PSW with your credentials. |
Target
| Setting | Values | What it does |
|---|---|---|
| Target | Single agent, Agent group | Issue to one server, or fan out to every current member of a group. Agent groups require Standard. |
| Agent / Agent group | Which one receives the job. A group re-resolves to its current membership on every renewal. For a rule that keeps applying as the fleet grows, use a certificate policy. |
The chosen target's operating system filters the deploy-target list in the next section: only matching or third-party presets are offered.
Deployment
Either Configure inline or pick a saved deploy target from Manage > Deploy Targets. The fields change with the preset - see Deploy targets for all 31.
Renewal
| Setting | Values | What it does |
|---|---|---|
| Auto-renew | toggle, default on | Queues a renewal automatically before expiry. |
| Renew this many days before expiry | 1-90, default 30 | How far ahead of not-after the renewal is triggered. |
| Private key type | EC-256 (default), EC-384, RSA-2048, RSA-4096 | Generated fresh for each issuance, under Advanced options. Free is limited to EC-256; an AD CS template's minimum RSA size filters the options. |
Notifications
Optionally send an email through one of your own mail apps when the certificate is issued. Off by default; enabling it requires a mail app and at least one of up to 10 recipients, plus an optional message of up to 500 characters.
Validation
Before the job is created, a certificate using HTTP-01 or TLS-ALPN-01 is checked for reachability: every one of its names is probed on the real public port 80 or 443, in parallel, and the first failure blocks the job with the challenge, the name, the reason and what is required. A private or unresolvable address counts as unreachable, because from a CA validator's vantage point it is.
The probe always tests the standard port even when the agent has a standalone port override - the override changes only where the agent binds locally.
Build > Certificate Job (Flow) is a node-based builder for the same underlying job: the same fields, laid out as a graph rather than a form. Neither is more capable.
Build > Certificate Policy
The same certificate specification, attached to an agent group as a standing rule. Five sections: Policy, Certificate, Deployment, Lifecycle, Notifications. See Certificate policies.
| Setting | Values | What it does |
|---|---|---|
| Name, description | What the policy is, for whoever reads it next. | |
| Applies to | an agent group | The group whose members this policy covers. |
| Mode | One certificate per agent; One shared certificate | Fixed at creation. Shared is currently unavailable. |
| Common name template | A template using {{hostname_short}}, {{hostname}} or {{agent_name}}, previewed live as you type. A per-agent policy must contain one. | |
| When the policy stops applying | Keep (default), Retire | Keep leaves the certificate in place, unmanaged. Retire switches auto-renew off and queues a revoke. Queued jobs are cancelled either way. |
Manage
Manage > Agents
The fleet list: name, status, version, certificate count, group, hostname, external and internal IP, when it registered and when it was last seen. New agent opens the three-section enrollment wizard (Platform, Installation, Verify).
Opening an agent gives four tabs - Overview, Certificates, Settings, Danger zone - plus Re-register. Every per-agent setting is documented on Agents.
Manage > Agent Groups
Name, member count, policy count and rollout state. A group has Overview, Policies, Members and Settings tabs. See Agent groups.
Manage > Domains
| Setting | Values | What it does |
|---|---|---|
| Domain name | The apex or delegated domain you will issue for. Globally unique across the platform. | |
| Internal domain | toggle, default off | Marks a domain that is not publicly resolvable. Skips TXT verification and requires an Internal CA (REST). |
| Ownership verification | TXT record | A one-time _aethercert-challenge record proves control. |
| DNS provider | 217 providers | Connect credentials so DNS-01 is solved automatically. Tried against the provider's API before saving where a live check is possible, then stored write-only in Vault. |
Manage > Connectors
CA connectors paired with an Internal CA (REST) authority: liveness, version, discovered templates, the CRL & CA health tab and the hardening checklist. See The CA connector.
Manage > Certificate Authorities
| Setting | Values | What it does |
|---|---|---|
| Name | Display name. | |
| Type | ACME CA, PSW Group, Internal CA (REST) | See Certificate authorities. |
| Provider (ACME) | preset list | Pre-fills the directory URL and the EAB requirement. |
| ACME directory URL | The authority's directory endpoint. | |
| EAB key ID / HMAC key | required for most public CAs | Generated in the authority's own dashboard. |
| PSW environment | Sandbox, Production | test-api.psw-group.de or api.psw-group.de. |
| PSW client ID / secret | From an application created under Configuration > API in your PSW console. | |
| Internal REST: base URL, signing path, API key | Where CSRs are posted, default path /sign. Or tick provision via a CA connector to have these filled in at pairing. | |
| Allow self-signed TLS | toggle, default off | Skip certificate verification when calling an internal REST authority. |
Manage > Deploy Targets
| Setting | Values | What it does |
|---|---|---|
| Name | required | How the saved target appears in the picker on a certificate job or policy. |
| Preset and fields | The same preset list and per-preset fields as on a certificate job. |
Save a target here once and any number of certificates can reference it instead of each carrying its own copy of the same appliance credentials. Editing one updates every certificate that references it at that certificate's next deployment; deleting one that is still referenced is refused. Creating and editing require the Admin role.
Manage > Certificate Policies
| Setting | Values | What it does |
|---|---|---|
| Apply now | action | Re-applies the policy to the group's current members. Idempotent. |
| Enable / Disable | action | Disabling stops the policy applying to anyone new and unapplies it from current members, keeping the policy itself. |
| Rollout state | Per-member state, including why a member is not applied. |
Manage > Jobs
Every issue, renew, deploy and revoke attempt, filterable by all, queued and running, failed, or by policy. See Jobs.
| Action | When |
|---|---|
| Retry | Failed jobs. Requeues with the attempt count reset. |
| Retry deploy | A job that issued but failed to deploy. |
| Cancel | Queued jobs that have not started. |
| Edit | Any job. Opens the certificate's edit dialog; saving reissues. |
| Delete | Any job, to clear it out of the history. |
Manage > Certificates
Every certificate in the organization - Managed and External - sorted by expiry. Search by name, SAN, issuer or fingerprint; filter by source. Badges above the table count expired, expiring, failed and hidden rows.
| Action | Notes |
|---|---|
| Renew now / Revoke / Delete / Edit | Managed certificates only. |
| Create job | On an external row: opens a certificate job for the same names, to take it over. |
| Hide / Unhide | Removes a row from the list without changing the certificate. Server-side, so it stays hidden for everyone. |
Opening a certificate shows its full record: validity, SANs by kind, subject and issuer attribute by attribute, key and signature algorithms, serial, fingerprints, extensions, and for an external certificate every store and file it was found in.
Monitoring
| Screen | What is on it |
|---|---|
| Event Log | Every issuance, renewal, deployment and administrative action, with its actor and outcome. Retention follows your plan. See Event log. |
| Email Notifications | Mail apps, and the history of every notification attempt. See Email notifications. |
| Integrations | Webhook, syslog/CEF and SNMP-trap sinks, plus metrics API keys. Pro and MSP only. See Monitoring integrations and the Monitoring API. |
MSP
Shown on the MSP plans only.
| Screen | What is on it |
|---|---|
| Customers | Customer workspaces, their licence tiers and slot renewal dates. Where slots are bought, assigned and released, and where a management invitation is created. |
| Shared Customers | Appears when another organization manages yours. Tick a customer to make that one workspace visible to them, at a role you choose. |
| Branding | White-label company name, logos, favicon, theme, font, support details, customer mail app and custom dashboard domains. MSP Plus. |
Help
Support routes you to whoever is responsible for your account - aethercert directly if you are an MSP or a direct customer, or your MSP if your workspace is one they manage. An organization with no MSP also sees the partner directory here. Report a Bug and Feature Request are open on every plan.
Settings
Reached from the account menu, not the sidebar. Two groups:
Personal - Profile, Appearance, Notifications, Security, Sessions.
Organization - General, Roles, Audit log, Members, Authentication, Billing, Branding, Danger zone.
Every page is documented on Organizations; roles and multi-factor authentication on Roles and permissions; single sign-on on Single sign-on.
Older links still work
Settings > Account and Settings > Organization > Single sign-on are redirects now,
landing on Profile and Authentication respectively.
Admin
Visible to aethercert staff accounts only, and not part of any customer plan. It carries the release catalogue and a platform-wide organization list.
Monitoring API
The Prometheus-format metrics endpoint: issuing a key, every metric it exposes, and pointing CheckMK, Prometheus, Grafana or Zabbix at it.
Plans and limits
What each aethercert plan allows: certificate, agent and domain counts, authorities, deploy targets, key types, check-in cadence and retention windows.