Overview
How aethercert issues, deploys and renews TLS certificates across Windows and Linux fleets - concepts, setup, and a reference for every screen and limit.
aethercert issues TLS certificates, installs them where they are needed, and renews them before they expire. These pages cover the whole of it: the concepts, the setup, and a reference for every screen, command and limit.
The short version
Five things make up a working setup. Each has its own page under Core concepts; this is how they relate.
| Agent | A small binary on each server that needs a certificate. It polls the control plane over outbound HTTPS - nothing connects into your network. |
| Domain | A DNS name, verified once with a TXT record. Connect a DNS provider to it and DNS-01 challenges are solved automatically. |
| Certificate authority | Where certificates come from: Let's Encrypt, another public ACME CA, a reseller, or your own internal CA. |
| Deploy target | What the agent does with the certificate once it has it - import it into a Windows store, write it to disk and reload nginx, upload it to a load balancer. |
| Certificate | A common name, a CA, a deploy target and a target agent, tied together. The control plane tracks its expiry and queues the renewal. |
Two more objects exist for fleets rather than single servers. An agent group is a named set of agents; a certificate policy is a standing rule on that group, so every server that joins it gets its certificate without anyone opening a form.
Finding your way around
Which page you want depends on what you're doing.
- Evaluating aethercert - read How it works, then Security and data handling.
- Setting it up for the first time - follow the Quickstart end to end, then come back for Installing the agent when you roll out more than one server.
- Connecting a specific service - the integration guides cover one certificate authority, DNS provider or identity provider each.
- Looking a setting up - it's in the dashboard reference, screen by screen.
- Something isn't working - start at Troubleshooting.
New to the terminology? The glossary defines every term these pages use, including the ACME ones.
Conventions used here
- Dashboard paths are written as they appear in the sidebar: Manage > Domains means the Domains entry under the Manage section.
- Commands are shown for both platforms where they differ.
sudomeans run it as root on Linux; PowerShell blocks assume an elevated (Administrator) prompt. - Placeholders in commands look like
<token>- replace the whole thing, angle brackets included. - Plan requirements are flagged inline, next to the feature they apply to. The full matrix is on the pricing page and in Plans and limits.
If a step here doesn't match what you see in the app, the documentation is out of date
- reporting it is genuinely useful.