FAQ

Operational questions and their answers. If something is failing rather than merely unclear, start at Troubleshooting instead.

Certificates

Which key type should I use?

EC-256 is the default and is correct almost everywhere. Use RSA-2048 or RSA-4096 only when a target explicitly requires RSA - some appliances and older Windows integrations do. RSA keys are larger and slower to generate, with no security benefit over EC-256 on current software.

Can I issue wildcard certificates?

Yes, with DNS-01 validation - which means a DNS provider connected to the domain. Wildcards cannot be issued over HTTP-01. That is an ACME rule, not an aethercert limitation.

Note that *.example.com matches a.example.com but not a.b.example.com. Nested subdomains need their own wildcard.

Can I move a certificate from one agent to another?

No - certificates are not re-targeted in place. Delete it and create a new one against the other agent.

If several servers need the same certificate, use an agent group rather than moving one repeatedly. That is what groups are for.

What is the difference between deleting and revoking?

Revoking asks the authority to stop trusting the certificate before it expires - use it when a key may have been exposed. Deleting removes the record from aethercert; the certificate keeps working wherever it is installed until it expires.

Neither reaches onto the host to remove a deployed file. See Certificates.

Does renewal keep the same key?

No. Every issuance, including every renewal, generates a fresh key and produces a new serial. Anything that pinned the old fingerprint needs to stop doing that.

What are those "external" certificates in my list?

Certificates your agents found already installed on their hosts, whoever put them there. They are tracked read-only so their expiry dates stop being invisible - aethercert has neither their key nor their issuance configuration, so it cannot renew them. See External certificates.

Agents and networking

Does the agent send private keys to aethercert?

No. The key is generated on the host that will serve the certificate and never leaves it. The agent reports metadata only: serial, fingerprint, validity, and the outcome.

Do I need to open a firewall port?

No. The agent makes outbound HTTPS connections and accepts none, so it works behind NAT and a closed inbound firewall. The only component that listens is the optional CA connector, and only on your internal network.

Can the agent run in a container?

Yes - enroll and run it in the foreground rather than installing a service. It gets no automatic updates that way, so rebuild the image on a new version. See Manual and foreground installs.

How do I roll out hundreds of agents?

One multi-provision token and the same install command, run by whatever already provisions your servers - a golden image, cloud-init, Ansible, Group Policy. Pick an agent group when generating the token and every host arrives in that group, so a certificate policy on it applies before the first check-in. See Unattended rollout.

Do I have to create the agents before the certificate?

No. Create the group, write the policy on it while it is still empty, then roll agents out. Each gets its certificate as it joins.

Availability and failure modes

What happens to my certificates if aethercert is unavailable?

Certificates already deployed keep working. They are ordinary files and store entries on your own servers, with no runtime dependency on aethercert - nothing phones home to validate them.

What pauses is scheduling: new issuance and renewals resume when the control plane is reachable again. The default 30-day renewal window is the margin that makes a short outage a non-event. Current and historical availability is at status.aethercert.com.

What if a renewal fails?

It retries automatically up to three times, then the job is marked failed and shows the error. With the default 30-day window that leaves a month to notice and fix it before anything expires - which is the reason not to shorten that window.

Can I self-host aethercert?

The agent binaries are served from the control plane's own agent-downloads/ folder, and the repository builds and runs as a standard Next.js application, so a self-hosted deployment is possible. It is not a supported, documented product today - if that is a requirement rather than a preference, ask.

Integrations

Which DNS providers are supported?

217 - the full set from the lego ACME library. Cloudflare, Route 53, Azure, Google Cloud, DigitalOcean, Hetzner and every other common one, plus ACME-DNS, a generic webhook and a custom script as escape hatches for anything not on the list. See Domains and DNS validation.

Which certificate authorities are supported?

Let's Encrypt out of the box; Google Trust Services, ZeroSSL, SSL.com and Actalis via EAB; PSW Group as a reseller; any ACME-speaking server including your own; and internal CAs over REST or through the AD CS connector. See Certificate authorities.

Is there a public API?

Not yet. The dashboard and the agent talk over an internal API today. A documented public API is on the roadmap - if it is a blocker, say so, since that is what moves it.

Can I connect an internal CA that is not AD CS?

Yes. If it speaks ACME, point aethercert at its directory URL. If it has an HTTP endpoint that signs a CSR, use the Internal CA (REST) type. The CA connector is only needed for AD CS specifically. See Connect an internal or private CA.

Access and accounts

Can I turn multi-factor authentication off?

No. Every session is multi-factor, by password plus authenticator code, by passkey, or through Entra SSO in an organization that relies on its own Conditional Access policies.

Why can a member not create deploy targets?

Because a deploy target runs commands as root or LocalSystem on your agent hosts. Creating one is closer to a code deployment than to a certificate setting, so it needs the admin role. Members can issue and renew certificates freely using targets that already exist. See Users, roles and access.

Can I export my data?

Your profile and organization memberships, yes - Settings > Account > Export my data, as JSON. Self-service export of certificates and the full event log is not built yet; ask if a specific compliance requirement needs it.

Where is aethercert hosted?

The application on Hetzner in Nuremberg, the database on Supabase in Frankfurt. Storage and processing stay in Germany. Cloudflare sits in front as a TLS-terminating proxy for DDoS protection - it handles traffic, not storage. See Security and data handling.