Certificate authorities
Connect Let's Encrypt, Google Trust Services, ZeroSSL, SSL.com, Actalis, the PSW Group reseller, or your own internal ACME or REST certificate authority.
A certificate authority entry tells aethercert where to request certificates from. Add one under Manage > Certificate Authorities, then select it when creating a certificate.
You can have as many as you like, and mix them freely - a public CA for anything external clients see, an internal CA for everything behind the firewall.
The four types
| Type | What it is | Needs |
|---|---|---|
| Let's Encrypt | Seeded on every account automatically. | Nothing. |
| ACME CA | Any authority that speaks ACME - other public CAs, or your own ACME server. | A directory URL, and usually an EAB key pair. |
| PSW Group | A commercial reseller, ordered through its own API rather than ACME. | API credentials from your PSW Group console. |
| Internal CA (REST) | A signing endpoint that takes a CSR and returns a certificate. Also the type an AD CS connector pairs with. | A base URL, and optionally an API key. |
Public ACME authorities
| Authority | EAB required | Notes |
|---|---|---|
| Let's Encrypt | No | Already on your account. A staging directory is available as a separate preset - use it while testing to avoid production rate limits. |
| Google Trust Services | Yes | Key pair from Google Cloud Console > Certificate Manager > Public CA. Supports wildcards and up to 100 SANs per certificate. |
| ZeroSSL | Yes | Key pair from the ZeroSSL dashboard, under Developer > ACME. The free tier caps at 100 certificates per account. |
| SSL.com | Yes | Key pair from the SSL.com account dashboard. The RSA and ECC endpoints are separate authorities - add whichever you need, or both. |
| Actalis | Yes | Key pair issued by Actalis. Free certificates are limited to a single domain plus its www variant. |
Selecting a provider preset fills in the correct directory URL, so the only thing you paste is the credential.
What "EAB required" means
An external account binding is a key ID and an HMAC key that tie an ACME registration to your existing account at that authority. Most public CAs other than Let's Encrypt will not accept a registration without one.
aethercert cannot generate these. They are proof that you control an account at that CA, so they can only come from that CA's own dashboard. Step-by-step:
PSW Group
PSW Group is a commercial reseller. Rather than ACME, aethercert talks to its ordering API: it submits the CSR the agent generated, then polls the order until the certificate is issued.
Two things follow from that, and both matter before you use it:
- Orders are real and billable. Every certificate is a purchase at PSW. A per-agent certificate policy therefore places one order per server, including for every server that joins the group later.
- Issuance is not immediate. Depending on the product, PSW may require domain validation steps or manual review. The certificate's detail sheet shows the order's validation state and counts down to the next poll.
A sandbox environment is available and is what the form defaults to. See Add PSW Group.
Internal and private authorities
For certificates that only need to be trusted inside your own organization. A private CA avoids public rate limits and keeps your internal hostnames out of certificate transparency logs entirely.
There are three shapes, depending on what your CA can do:
| Your CA | Use |
|---|---|
| Speaks ACME (step-ca, most internal PKI products) | Type ACME CA, provider Custom / self-hosted ACME server, pointed at its directory URL. Add an EAB pair only if it requires one; most do not. |
| Has an HTTP endpoint that signs a CSR | Type Internal CA (REST) with the base URL, the signing path (default /sign) and an API key if required. |
| Is Active Directory Certificate Services | Type Internal CA (REST), provisioned by a CA connector installed on the CA host. |
Full walkthrough: Connect an internal or private CA.
Choosing an authority per certificate
| The certificate is for | Use |
|---|---|
| Anything a browser or external client must trust | A public authority - Let's Encrypt unless you have a reason otherwise |
| A name whose existence you would rather not publish | An internal CA - public certificates are recorded in public CT logs, hostnames included |
| An internal-only service where every client already trusts your root | An internal CA - no rate limits, no external dependency |
| A requirement naming a specific commercial CA | That CA via EAB, or PSW Group if it is only sold through a reseller |