Dashboard reference
Every screen in the aethercert dashboard and every setting on it - certificate jobs and policies, deploy targets, agents, domains, authorities and settings.
This page documents every screen and every setting. It is a reference, not a walkthrough - if you are setting aethercert up for the first time, start with the Quickstart.
The dashboard sidebar groups screens into View, Build, Manage, Monitoring and Settings, and this page follows the same order. Settings that depend on your plan are flagged where they appear.
View
The read-only overview. View > Certificates lists every certificate sorted by expiry; View > Agents lists connection health.
Certificate detail sheet
| Setting | Values | What it does |
|---|---|---|
| Status | Issued · Deployed · Renewing · Failed · Revoked | Where the certificate is in its lifecycle. A failed job surfaces its error inline, in plain language. |
| Common name & SANs | The identities the certificate covers. | |
| Authority / Target / Key type | Which authority issued it, which agent or group serves it, and the private-key algorithm. | |
| Serial · Fingerprint · Validity | Serial number, SHA-256 fingerprint, and the not-before/not-after window - reported by the agent, never the key itself. | |
| Subject · Issuer · Extensions | external | For a certificate discovered on a host, the full parsed X.509 record: both distinguished names attribute by attribute, every SAN by kind, public key and signature algorithms, SHA-256 and SHA-1 fingerprints, key usage and extended key usage, basic constraints, key identifiers, policy OIDs, OCSP/CRL/AIA endpoints, and the certificate's own PEM. |
| Where it's installed | external | Every store and file the agent's last scan found it in, whether the host holds a private key for it, and when it was last seen. |
| Order state | PSW Group | The reseller order's validation state, and a countdown to the next poll. |
| Renew now | action | Queues an immediate renewal for the certificate's current target. Managed certificates only. |
| Revoke | action | Queues a revoke job that calls the authority's real revoke operation, not a local status flip. |
| Edit | action | Opens the edit dialog. Saving reissues with the new configuration. |
Build
Where certificates, policies, agents, domains and authorities are created. Two of these creation screens sit under Manage in the sidebar rather than Build - the headings below name the path the app actually uses.
Build > Certificate Job
The main form. It ties an identity, an authority, a deploy target and a schedule together and queues the issue job.
Build > Certificate Job (Flow) is a node-based builder for the same underlying job - the same fields, laid out as a graph rather than a form. Neither is more capable than the other; use whichever reads better to you.
Certificate section
| Setting | Values | What it does |
|---|---|---|
| Domain | optional | Pick a verified domain to enable DNS-01 and enter hostnames as just the label - the domain is appended, so you cannot produce a hostname DNS-01 could not cover. Leave empty for HTTP-01 or an internal authority. |
| Certificate authority | Which authority issues this certificate. Free is limited to Let's Encrypt; internal domains require an Internal CA (REST). | |
| Certificate template | internal_rest only | Shown when the selected authority is a paired connector. Chooses the AD CS template; Connector default uses the one it was installed with. Inline hints warn about client-auth and subject-from-AD templates. |
| Common name | The primary hostname. With a domain selected, enter only the label. | |
| Subject alternative names | 0..n | Additional hostnames on the same certificate. |
| PSW product | psw_group only | Which PSW Group product to order. Each order is real and billable. |
Target section
| Setting | Values | What it does |
|---|---|---|
| Target | Single agent · Agent group | Issue to one server, or fan out to every current member of a group. Agent groups require Standard. |
| Agent / Agent group | Which agent or group receives the job. A group re-resolves to its current membership on every renewal. For a rule that keeps applying as the fleet grows, use a certificate policy. |
Renewal section [#renewal]
| Setting | Values | What it does |
|---|---|---|
| Auto-renew | toggle, default on | Queues a renewal automatically before expiry. |
| Renew this many days before expiry | days, default 30 | How far ahead of not-after the renewal is triggered. |
| Private key type | EC-256 · EC-384 · RSA-2048 · RSA-4096, default EC-256 | Generated fresh for each issuance, under Advanced options. Free is limited to EC-256; some AD CS templates enforce a minimum RSA size. |
Build > Certificate Policy
| Setting | Values | What it does |
|---|---|---|
| Name / Description | What the policy is, for whoever reads it next. | |
| Applies to | an agent group | The group whose members this policy covers. |
| Mode | One certificate per agent · One shared certificate, fixed after creation | Per agent gives each member its own certificate, common name and order - required for PSW Group. Shared issues one certificate for the whole group. |
| Common name | A literal hostname in shared mode; in per-agent mode a template using {{hostname_short}}, {{hostname}} or {{agent_name}}, previewed live as you type. | |
| Authority / template / product / challenge / SANs / key type | The same meanings as on a certificate job - the policy carries the spec its certificates are built from. | |
| Deploy target | Where each member installs the certificate. Members whose OS cannot run it are reported rather than applied. | |
| When the policy stops applying | Keep · Retire, default Keep | Keep leaves the certificate in place, unmanaged. Retire stops renewal and queues a revoke. |
Build > Certificate Authorities
| Setting | Values | What it does |
|---|---|---|
| Name | Display name for the authority. | |
| Type | ACME CA · PSW Group · Internal CA (REST) | ACME covers Let's Encrypt, other public CAs and self-hosted ACME servers. PSW Group is a reseller ordered through its own API. Internal REST is a generic signing endpoint or an AD CS connector. |
| Provider (ACME) | preset list | Pre-fills the directory URL and the EAB requirement for Google Trust Services, ZeroSSL, SSL.com, Actalis, Let's Encrypt staging, or a custom server. |
| ACME directory URL | The authority's ACME directory endpoint. | |
| EAB key ID / HMAC key | required for most public CAs | Generated in the authority's own dashboard. |
| PSW environment | Sandbox · Production | test-api.psw-group.de or api.psw-group.de. |
| PSW client ID / secret | From an application created under Configuration > API in your PSW Group console. | |
| Internal REST: base URL / signing path / API key | Where CSRs are posted (default path /sign) and the bearer key. Or tick provision via a CA connector to have these filled in at pairing. | |
| Allow self-signed TLS | toggle, default off | Skip TLS verification when calling an internal REST authority over a self-signed endpoint. |
Manage > Agents
The install wizard. Choose the component (fleet agent or CA connector), the operating system, and single- or multi-provision, and it returns a download link and an install command. Optionally pick an agent group, which the enrollment token then carries.
Tokens are shown once. See Installing the agent.
Manage > Domains
| Setting | Values | What it does |
|---|---|---|
| Domain name | The apex or delegated domain you will issue for. | |
| Internal domain | toggle, default off | Marks a domain that is not publicly resolvable. Skips TXT verification and requires an Internal CA (REST). |
| Ownership verification | TXT record | A one-time _aethercert-challenge record proves control. |
| DNS provider | 217 providers | Connect credentials so DNS-01 is solved automatically. Tested against the provider's API before saving, then stored write-only in Vault. |
Deploy target settings
Chosen inline on the certificate job or policy, or picked from a saved object under Manage > Deploy Targets. Pick a family (Windows roles, web servers, load balancers, firewalls, hypervisors & virtualization, DevOps & orchestration, or custom script), then a preset - the field tables below cover a representative preset per mechanism, not every one. The full field reference and behavioural detail for all presets is in Deploy targets.
Linux - NGINX / Apache / Custom
| Setting | Values | What it does |
|---|---|---|
| Certificate path | required | Where the leaf certificate (PEM) is written. |
| Key path | required | Where the private key (PEM) is written. |
| Chain path | optional | Where the issuer chain is written, if your server wants it separately. |
| Reload command | optional | Runs after the files land. Pre-filled for the NGINX and Apache presets; blank for Custom. |
| HTTP-01 webroot | optional | Serve HTTP-01 challenges from an existing web root instead of binding port 80. Not needed with DNS-01. |
| nginx.conf path | NGINX preset | Parsed to find the worker user, so the key is made readable to it. Default /etc/nginx/nginx.conf. |
Windows - Certificate store / IIS
| Setting | Values | What it does |
|---|---|---|
| Store location | default LocalMachine | LocalMachine or CurrentUser. |
| Store name | default My | The store to import into. |
| IIS site name | IIS preset only | The site whose HTTPS binding is created or updated. |
| IIS binding host / port | optional | Host header and port; port defaults to 443. Requires Standard. |
| Allow private key export | toggle, default off | Whether the imported key is marked exportable. Requires Standard. |
Windows - Exchange
| Setting | Values | What it does |
|---|---|---|
| Services to enable | IIS · SMTP · POP · IMAP · UM | Which services the certificate is enabled for via Import-ExchangeCertificate. Assumes the agent runs on the Exchange server with the Management Shell present. |
| Allow private key export | toggle, default off | Requires Standard. |
Windows - ADFS
| Setting | Values | What it does |
|---|---|---|
| Certificate usage | Service communications · Token signing · Token decrypting, default Service communications | How the certificate is assigned in ADFS. Assumes the agent runs on the ADFS server with the ADFS PowerShell module present. |
| Allow private key export | toggle, default off | Requires Standard. |
Third-party - Citrix NetScaler
| Setting | Values | What it does |
|---|---|---|
| Management URL | required | The NetScaler/ADC management endpoint. Works from an agent on either OS. |
| Username / Password | required | Nitro API credentials. The password is stored encrypted in Vault and never returned to the browser; leave it blank when editing to keep the current one. |
| Cert key name | required | Name of the sslcertkey object created or updated on the appliance. |
| Allow self-signed TLS | toggle, default off | Skip TLS verification of the management endpoint. |
Deployment uploads the certificate and key and creates or updates the sslcertkey. It
does not bind it to an SSL vserver - do that in NetScaler.
Third-party - Docker container
| Setting | Values | What it does |
|---|---|---|
| Container | required | Which running container to copy into. |
| Socket / named pipe | default per OS | /var/run/docker.sock, or \\.\pipe\docker_engine on Windows. |
| Paths inside the container | required | Where certificate, chain and key are written inside the container. |
| Reload command | optional | Runs inside the container via the Exec API. Left blank, the container is restarted instead. |
Custom script
| Setting | Values | What it does |
|---|---|---|
| Script | filename only | Selected from the agent's scripts directory. Script content is never uploaded through the dashboard. |
| Variables | 0..n | Passed as AC_VAR_<NAME> environment variables, never interpolated into a shell command. |
| Secret variable | toggle | Stores that value encrypted in Vault; it is never shown again once saved. |
Manage
Manage > Certificates
Every certificate in the organization: the ones aethercert issues and deploys (Managed) and the ones agents found already installed (External - see External certificates). Filter by source, search by name, SAN, issuer or fingerprint.
| Setting | Values | What it does |
|---|---|---|
| Source filter | All · Managed · External | Shown once at least one external certificate has been discovered. |
| Renew now / Revoke / Delete | action | Managed certificates only. External rows show read-only instead. |
Manage > Agents
| Setting | Values | What it does |
|---|---|---|
| Name | Display name for the agent. | |
| Check-in interval | 1800-10800 seconds | How often the agent checks in when idle. It still checks in sooner whenever a job or update is queued. Bounded by your plan; leave empty for the default. |
| Group | none · a group | An agent belongs to at most one group. Saving a new group applies every policy on it; moving out unapplies them and cancels their still-queued jobs. |
| Auto-update | toggle, default on | Off pins this agent's version and reveals the manual update command. |
| Local log retention | days | On-host log retention. Fixed at 7 days on Free; up to the plan cap otherwise. |
| Revoke | action | Immediately stops the agent authenticating. Irreversible - the host must be re-enrolled. |
| Delete | action | Removes the agent record. Blocked while certificates target it. |
Manage > Agent Groups
| Setting | Values | What it does |
|---|---|---|
| Name | Group name. Requires Standard to create or target. | |
| Members | Edited on the Members tab, or from each agent's own Group setting. Adding applies every policy on the group; removing unapplies them. | |
| Policies | Every policy attached to this group, each with a rollout meter. | |
| New policy for this group | action | Opens the policy form pre-scoped to this group. |
Manage > Certificate Policies
| Setting | Values | What it does |
|---|---|---|
| Apply now | action | Re-applies the policy to the group's current members. Idempotent - members already covered are untouched. |
| Enable / Disable | action | Disabling stops the policy applying to anyone new and unapplies it from current members, keeping the policy itself. |
| Rollout state | Per-member state, including why a member is not applied. |
Everything else is the same form as Build > Certificate Policy.
Manage > Deploy Targets
| Setting | Values | What it does |
|---|---|---|
| Name | required | How the saved target appears in the picker on a certificate job or policy. |
| Preset and fields | Same preset list and per-preset fields as Build > Certificate Job. |
Save a deploy target here once and any number of certificates or policies can reference it, instead of each one carrying its own copy of the same appliance or cluster credentials. Editing a saved target's credentials updates every certificate that references it on its next deployment; deleting one that is still referenced is blocked until nothing points at it. Creating and editing require the organization Admin role - see Roles and permissions.
Manage > Domains, Certificate Authorities, CA Connectors
The same forms as under Build, for editing what already exists. The Connector panel on an Internal CA (REST) mints a one-time pairing token and shows liveness and discovered templates once paired - see The CA connector.
Manage > Jobs
| Setting | Values | What it does |
|---|---|---|
| Edit certificate | action | Opens the full edit dialog. Saving reissues with the new configuration. |
| Cancel | queued jobs | Cancels a job that has not started. |
| Retry | failed jobs | Requeues a failed job with its attempts reset. Jobs auto-retry up to 3 times before being marked failed. |
| Delete | action | Removes a job from the history. |
Monitoring
Monitoring > Event Log records every issuance, renewal, deployment and administrative action with its outcome, searchable for incident review. Retention is set by your plan - 7 days on Free, 30 on Standard, 90 on Pro and MSP. See Monitoring and the event log.
Monitoring > Email Notifications configures the mail app(s) used to send an email through your own mail infrastructure the moment a certificate is issued, and shows the history of every notification attempt.
MSP
Shown on the MSP plan only. MSP > Customers lists your customer workspaces, their licence tiers and slot renewal dates, and is where slots are bought, assigned and released. It is also where a management invitation is created, for a customer who already has an organization of their own.
MSP > Shared Customers appears when another organization manages yours. It is the list of your own customers, and ticking one makes that single workspace visible to them at the role you choose. See MSP customer workspaces.
Settings
Settings > Account
| Setting | Values | What it does |
|---|---|---|
| Display name | Your name as shown in the app. | |
| Two-factor authentication | authenticator app | A 6-digit code from any TOTP app. You can keep several; at least one always stays enrolled. |
| Passkeys | optional | Touch ID, Windows Hello, a phone or a security key - skipping both the password and the code. Removing them all puts you back on password plus code. |
| Marketing consent | toggle | Opt in or out of product emails; the timestamp of the choice is recorded. |
| Export my data | action | Downloads your profile and organization memberships as JSON (GDPR Art. 20). Rate-limited to once per hour. |
| Delete account | action | Erases your account and any organization you solely own (GDPR Art. 17). Requires a completed second factor, and is blocked if it would strand other members or MSP customer workspaces. |
A password and an authenticator app stay enrolled regardless, so no method is ever the only way in. Irreversible actions re-check the requirement server-side.
Settings > Organization
| Setting | Values | What it does |
|---|---|---|
| Organization profile | owner only | Name, contact name, address, email and phone. The plan is not editable here - it changes through billing. |
| Active organization switcher | Switch between organizations you can reach: those you belong to, plus the managed workspaces your membership covers. Remembered per session. |
Settings > Organization > Members
| Setting | Values | What it does |
|---|---|---|
| Invite by email | owner only | Sends a single-use invite link, also shown in-app as a fallback. The role - and the customer access, where there are customer workspaces - is chosen at invite time. |
| Role | Viewer · Member · Admin · Owner | See Users, roles and access. The last owner cannot be demoted or removed. |
| Customer access | All · Selected · No customers | Only shown when this organization manages customer workspaces. "Selected" opens the list of workspaces to assign, each with its own role. Owners are always "all". |
| Remove member / revoke invite | action | Removes access immediately, together with that member's customer assignments. |
| Reset two-factor | owner only | Clears another member's second factors when they lose their device. They enroll a new one at next sign-in. |
Settings > Organization > Billing
| Setting | Values | What it does |
|---|---|---|
| Plan | Free · Standard · Pro · MSP | The current plan and its usage against its limits. Owner only. See Plans and limits. |
| Customer slots | MSP only | Customer workspaces beyond the included 5, bought through Stripe Checkout. |
| Billing portal | action | Opens Stripe's customer portal for payment method, invoices and cancellation. |
Settings > Organization > Single sign-on
Optional, owner only, configured with your own Entra app registration. Password sign-in keeps working alongside it.
| Setting | Values | What it does |
|---|---|---|
| Directory (tenant) ID / Application (client) ID | Identify the app registration you created in your own Entra tenant. | |
| Client secret | write only | Stored encrypted in Vault and never shown again. Entra secrets expire - rotate here before they do. |
| Email domains | Which addresses are routed to your tenant at the sign-in page, and accepted coming back. A domain can only be claimed by one organization. | |
| Role for new members | Viewer · Member · Admin · Owner | The role people get on first sign-in. |
| Create accounts on first sign-in | toggle | Off: only people who are already members can sign in with Microsoft. |
| Trust our Conditional Access for two-factor | toggle, default on | A Microsoft sign-in does not need aethercert's own second factor, because your tenant's policies already govern it. Never applies to a password sign-in. |
| Single sign-on enabled | toggle | Suspends federated sign-in without deleting the configuration. |
| Direct sign-in link | copy | Goes straight to your tenant with no aethercert sign-in page in between. Set it as the app registration's home page URL to get aethercert into the Microsoft 365 app launcher. |
Help
Help > Support routes you to whoever is responsible for your account - aethercert directly if you are an MSP or a direct customer, or your MSP if your workspace is one they manage. Report a Bug and Feature Request are open on every plan.