MSP customer workspaces

Run aethercert as a managed service: isolated customer workspaces, slots and licence ownership, staff scoped per customer, shared customers, and white labeling.

The MSP plans turn aethercert into something you operate for other people. Each customer gets a fully isolated workspace; you manage all of them from one login and one invoice, and you decide independently what to charge each of them.

There are two tiers. MSP is the reseller capability. MSP Plus is MSP plus white labeling - your own dashboard hostname, name, logo, colours and typeface - and nothing else. Every capacity number is identical between them.

What isolation means here

Every customer is a separate organization, with its own domains, agents, certificates, authorities, members and event log. It is not a shared tenant filtered by a customer ID. There is nothing for one customer to see about another, because there is no query that spans them.

Your own MSP organization is separate again. It has its own certificates and agents if you want them, and it is where slots, billing and the customer list live.

Access to a customer workspace comes from exactly two places:


You manage it	You created the workspace, or its owner accepted your management invitation.
It was shared with you	Another organization that manages it gave you access to that one workspace, at a role they chose.

Neither is inherited any further. Managing an organization does not reach the organizations it manages.

Slots and licences

A slot is a licence you own. It has a tier, its own annual subscription and its own renewal date, and it sits in your pool until you assign it to a customer.


Included	5 slots with an MSP plan.
Buying more	From MSP > Customers, on demand, at an MSP rate.
Tiers	Standard or Pro.
Assigning	Assign a slot to a customer and that workspace immediately runs at that tier.
Reassigning	Unassign it from one customer and give it to another. The slot keeps its own renewal date.
Auto-renew	Controlled per slot. Turn it off and the slot lapses at its renewal date rather than billing again.

The tier decides the plan limits inside that customer's workspace - certificate and agent counts, check-in cadence, event log retention - exactly as if they had bought that plan directly.

Buy the slot, then assign it

The two steps are deliberately separate. A slot bought in advance sits unassigned and ready, so signing a customer on a Friday afternoon does not wait on a payment flow.

Customers who pay for themselves

A workspace's plan comes either from your slot pool or from the customer's own subscription - never both, and the customer list says which.

A customer who bought Standard or Pro directly keeps that subscription when you take over managing them. Their tier, renewal date and invoice stay theirs, and assigning one of your slots on top is refused rather than silently applied: it would leave them paying Stripe for a plan they no longer have.

To move such a workspace onto your slot pool, the customer cancels their own subscription first. Once it lapses the workspace drops to Free, and a slot can back it from then on. It works the other way round too: if a managed customer later buys their own subscription, that takes over and the slot you had assigned is released back into your pool.

Who on your team sees which customer

By default every member of your MSP organization works in every customer workspace, at whatever role they hold with you. Under Settings > Organization > Members, each person can instead be set to selected customers and assigned the workspaces they actually look after, with a role chosen per workspace. No customers keeps somebody in your own workspace only.

The details, including why owners are always unrestricted, are in Roles and permissions.

Onboarding a customer

From MSP > Customers, create the customer workspace. You provide:

Section	What goes in it
Customer details	Name - which appears on invoices and becomes the Stripe company name - a contact person, an email address, and the language for their notifications.
Billing and invoicing	Where invoices are sent (defaults to your own organization's address), phone, country, address, and a tax or VAT number.
Licence	The workspace tier, taken from an unassigned slot.

The workspace is created immediately and you can start working in it - add domains, enroll agents, issue certificates - before the customer ever signs in, or without them ever signing in at all.

Giving the customer access

Two models, both supported:

You operate it entirely. The customer never gets a login. You manage their certificates by switching workspaces.
The customer sees their own workspace. Invite them into their organization at whichever role fits - viewer for read-only visibility, member for day-to-day work, admin if they should configure deploy targets themselves.

Bringing an existing organization under management

For a customer who already uses aethercert, use a management invitation: MSP > Customers > Invite an existing organization produces a single-use link, valid for 14 days, optionally tied to one email address.

An owner of that organization opens the link, picks which of their organizations to hand over, and confirms. Only then does the relationship exist - neither side can create it alone, which is what stops an organization being pulled into a customer list it never agreed to, or attaching itself to a provider that never invited it.

They also choose how much the arrangement covers:

	What you get
Operate it	Everything operational, deploy targets included. Billing, their member list and deleting the organization stay with them. The default.
Full control	Everything, the same as a workspace you created yourself.

Their existing licence is untouched by accepting.

Either side can end it. You from the customer's page under MSP > Customers, they from Settings > Organization > Danger zone. Neither needs the other's agreement.

Why the narrower option is the default

Managing a workspace at full control includes its member list - and a member of an organization sees the customers that organization manages. For a provider you manage, that would be a way around the per-customer sharing below. "Operate it" keeps the member list with them, so what you see of their customers is exactly what they shared.

Managing another provider

An MSP organization can be managed by another MSP organization - a parent company overseeing several providers, or one provider subcontracting another.

What the managing side sees is deliberately limited: the managed provider's own workspace, and not that provider's customers.

To open up an individual customer, the provider that manages it ticks it under MSP > Shared Customers and chooses the role that share grants - viewer, member or admin. Everything unticked stays invisible. Unticking it again takes the access away immediately, along with any staff assignments that pointed at it.

A share is not a handover

Owner is not available as a shared role. Billing, member management and deleting a workspace stay with the organization that actually manages the customer, so a share can never become a takeover. Staff of the receiving organization can also be scoped to individual shared customers, exactly like customers of their own.

White labeling

MSP Plus adds branding, configured under MSP > Branding.

Setting	Effect
Company name	Replaces aethercert's name across a customer's dashboard.
Logos	A light and a dark variant. PNG, JPEG, WebP or ICO - SVG is deliberately not accepted, because an SVG is a script carrier served back under our own origin.
Favicon	Square. Also what a customer gets when they add the dashboard to a home screen, together with your company name.
Theme	Your colours.
Font	A built-in face, or your own `.woff`/`.woff2` by URL.
Support details	The email and URL a customer's in-app support screen points at.
Customer mail	One of your own mail apps, so messages to customers leave from your domain and pass your SPF, DKIM and DMARC.

The emails your customers receive follow the same branding: workspace invitations and certificate notifications carry your logo, name, accent colour and support contact. If a send through your own mail server fails, the message still goes out through aethercert and the fallback is recorded in your event log. Messages about your account - billing, sign-in, password - stay aethercert's and are always sent by us.

A custom dashboard hostname

MSP Plus also lets a hostname of yours - dash.example.com - resolve to your customers' dashboard. Add it under MSP > Branding, then publish two DNS records:

_aethercert-portal.dash.example.com.  TXT    "aethercert-portal-verification=<token>"
dash.example.com.                     CNAME  <the target the settings page shows>

The TXT record proves you control the name; the CNAME points it at the shared portal entry point. Both are checked together, so one round of checking tells you everything still missing. A hostname becomes a portal only once ownership is proven - never because it happens to point at us.

A proxied CNAME cannot be confirmed

A CNAME hidden behind a proxy - Cloudflare's orange cloud, for instance - does not resolve as a CNAME, so the check cannot see it. Publish it unproxied at least until the domain is active.

Only an active domain - ownership proven and CNAME confirmed - serves a portal. Losing the MSP Plus entitlement disables it rather than deleting it.

Billing and support responsibility

	Who is responsible
Paying aethercert	You. One invoice covers your plan and every slot. A customer who kept their own subscription is invoiced by aethercert directly for that one workspace.
Charging the customer	You, at whatever price you set. aethercert has no relationship with your customer.
First-line support for the customer	You. A customer workspace's in-app support screen points its users at you, using the contact details on your MSP organization. Keep those current.
Support for you	aethercert. As an MSP you are a direct customer.

You can also list your organization in the partner directory, which puts your company name, contact person, email, phone, city and a short description in front of aethercert organizations that do not yet have an MSP. It is opt-in, from Settings > Organization > General.

Ending a customer relationship

Unassign the slot. The workspace keeps one of the included places if you still have one free, and otherwise drops to Free-plan limits. It is never deleted, so nothing is destroyed and nothing is retracted: certificates already deployed keep working, and the data is still there if the customer comes back. Then either reassign the slot, or turn its auto-renew off and let it lapse.

Detaching the workspace ends the relationship itself. The workspace becomes independent, its licence goes back to it - a slot you were paying for is released into your pool - and everything that hung off the relationship disappears with it: shares of that workspace, and your team's assignments to it.

Deleting a customer workspace outright is a separate, deliberate action. An account deletion is refused if it would strand an MSP customer workspace, so a workspace cannot disappear as a side effect of somebody closing a personal account.

Auf dieser Seite