Add PSW Group
Connect the PSW Group reseller API to aethercert: creating API credentials, sandbox versus production, ordering, and how validation and billing differ.
PSW Group is a commercial certificate reseller. Unlike the ACME authorities, aethercert talks to its ordering API: it submits the CSR your agent generated, then polls the order until the certificate is issued.
1. Create API credentials
They are separate systems with separate credentials. Credentials from one do not
work against the other.2. Connect it in aethercert
The secret is stored encrypted and never returned to the browser. Leave the field empty when editing to keep the stored value.
3. Order a certificate
Select this authority under Build > Certificate Job. One extra field appears:
| Field | What it does |
|---|---|
| PSW product | Which product to order. The list is fetched live from PSW using your credentials, so it reflects what your account can actually buy. |
Everything else is the same as any other certificate: the agent generates the key and CSR locally, and the key never leaves that host.
What happens after you save
Issuance is not immediate, and this is the main practical difference from ACME.
- aethercert submits the order with the agent's CSR.
- PSW may require domain validation - by email, HTTP, CNAME, DNS TXT or meta tag, depending on the product - and some products involve manual review.
- aethercert polls the order every three minutes. The certificate's detail sheet shows the order's validation state and counts down to the next poll.
- Once PSW issues, the certificate is deployed and renewal is scheduled as normal.
So a job sitting in a pending state here is usually correct behaviour, not a failure. Check the validation state on the certificate before treating it as one.
Policies and PSW
A certificate policy using a PSW authority must be in per-agent mode. Shared mode is not available, because a single certificate shared across several agents would have them overwrite each other's order state - PSW tracks one order per certificate.
The consequence is the billing one at the top of this page: one order per member, now and for every member that joins later. The policy form states this explicitly before you save.
Revocation
PSW revocation is a server-side API call rather than something an agent does. A policy set to retire therefore stops a PSW certificate renewing but does not revoke it - do that at PSW by hand if it is needed.