Quickstart

Create an account, install an agent, verify a domain, and issue your first automatically renewing TLS certificate - about ten minutes for one server.

This is the whole path from a new account to a certificate that installs itself and renews on schedule. On a single server it takes about ten minutes, most of which is waiting for a DNS record to propagate.

1. Create an account

Sign up from Get started. The Free plan needs no payment details and covers one certificate on one agent for one domain, which is exactly what this walkthrough uses.

The first screen after signing up asks for an organization name and its contact details - a contact person, email, phone and address, so billing and support have somewhere real to reach before anyone visits the settings page. Everything you create from then on - domains, agents, certificates - belongs to that organization, and it is created once, here. If someone has already invited you to theirs, that invitation is offered on the same screen: accept it and you work in their organization instead of starting an empty one of your own - no contact details needed in that case, since the organization already has its own.

The same URL is where you sign in afterwards - there is no separate login page.

2. Install an agent

The agent is what actually holds the certificate, so it goes on the server that will serve it.

```bash
chmod +x aethercert-installer-linux-amd64
sudo ./aethercert-installer-linux-amd64 install \
  --api https://your-app.example.com \
  --token <token>
```

On Windows, from an elevated PowerShell:

```powershell
.\aethercert-installer-windows-amd64.exe install `
  --api https://your-app.example.com `
  --token <token>
```

That single command enrolls the server, downloads the agent build, registers it as
a service, and starts it.

Every other install case - containers, unattended rollout, the Windows setup window - is covered in Installing the agent.

3. Add and verify a domain

Go to Manage > Domains and add the domain the certificate will cover. aethercert gives you a TXT record to publish at your DNS host; once it resolves, press Verify. This is a one-time step per domain.

On the same screen you can connect a DNS provider. That is optional, and it decides which validation method is available to you:

Without a DNS provider, certificates are validated over HTTP-01. The hostname has to be reachable from the internet on port 80 at issuance time, and wildcard certificates are not possible.
With a DNS provider connected, DNS-01 becomes available. aethercert creates and removes the challenge records itself, wildcards work, and the hostname does not have to be publicly reachable at all.

Connect one if either of those matters to you. The full provider list and the credential each needs are in Domains and DNS validation.

4. Choose a certificate authority

Every account is seeded with a Let's Encrypt entry that needs no configuration, so there is nothing to do in this step unless you want a different authority.

If you do, add it under Manage > Certificate Authorities first - another public CA, a reseller, or your own internal CA. See Certificate authorities.

5. Create the certificate

Go to Build > Certificate Job and fill in four things:

The identity - the common name, plus any subject alternative names. With a domain selected you enter just the label (app) and the domain is appended for you.
The authority - the certificate authority from step 4.
The deploy target - what the agent should do with the certificate once it has it: import it into the Windows certificate store, write it to disk and reload nginx, upload it to a load balancer. See Deploy targets.
The target - the agent from step 2.

Save, and the issue job is queued. The agent claims it on its next check-in, which the control plane shortens to roughly ten seconds whenever work is waiting, so in practice it starts immediately.

6. Confirm it renews itself

Open the certificate from View > Certificates. Auto-renew is on by default, and the renewal is queued a configurable number of days before expiry - 30 by default.

From here nothing needs a human. The control plane tracks the expiry date, queues the renewal job, the agent reissues and redeploys, and every attempt - success or failure - lands in the event log.

Where to go next

Rolling this out beyond one server changes the shape of the work: instead of creating one certificate per host, you write the rule once and let the fleet grow into it.