Plans & limits
What each aethercert plan allows: certificate, agent and domain counts, authorities, deploy targets, key types, check-in cadence, and log retention.
Five plans: Free, Standard, Pro, MSP and MSP Plus. This page is the technical matrix - what each one allows and what happens when you reach a limit. Prices and the commercial comparison are on the pricing page.
Capacity
| Free | Standard | Pro | MSP | MSP Plus | |
|---|---|---|---|---|---|
| Certificates | 1 | 150 | 1,500 | 150 | 150 |
| Agents | 1 | 75 | 1,000 | 75 | 75 |
| Domains | 1 | 5 | 25 | 5 | 5 |
| Customer workspaces | - | - | - | 5 included, more on demand | 5 included, more on demand |
MSP's and MSP Plus's own numbers are Standard's. They govern the reseller organization's own workspace; each customer workspace runs on the tier of the slot assigned to it and gets that tier's numbers.
A customer who pays for their own Standard or Pro subscription keeps it when an MSP takes over managing them, and does not use one of the included places. Their plan and renewal date stay their own - see MSP customer workspaces.
Capabilities
| Free | Standard | Pro | MSP | MSP Plus | |
|---|---|---|---|---|---|
| Certificate authorities | Let's Encrypt only | Any, including your own internal or private CA | Any | Any | Any |
| Deploy targets | Windows Certificate Store, Linux NGINX / Apache / Custom | All | All | All | All |
| IIS bindings | No | Yes | Yes | Yes | Yes |
| Exportable private keys | No | Yes | Yes | Yes | Yes |
| Agent groups | No | Yes | Yes | Yes | Yes |
| Certificate policies | No | Yes | Yes | Yes | Yes |
| Key types | EC-256 only | EC-256, EC-384, RSA-2048, RSA-4096 | All | All | All |
| DNS providers | All 217 | All 217 | All 217 | All 217 | All 217 |
| Monitor integrations | No | No | Yes | Yes | Yes |
| White-label branding & custom dashboard domain | No | No | No | No | Yes |
| Roles, MFA, passkeys, SSO | All plans |
MSP Plus is MSP plus white labeling: your customers reach the dashboard on your own hostname, under your own name, logo, colours and typeface. Everything underneath - containers, database, API, agents - is unchanged. Set it up from MSP > Branding once you are on the plan.
The emails your customers receive follow the same branding: workspace invitations and certificate notifications carry your logo, your company name, your accent colour and your support contact instead of ours. Under MSP > Branding > Customer mail you can also pick one of your own mail apps (the same ones you configure under Monitoring > Email Notifications > Mail apps) to send them, so they leave from your domain and pass your SPF, DKIM and DMARC. If a send through your server fails, the message still goes out through aethercert and the fallback is recorded in your event log.
Messages about your account rather than your customers' - billing, sign-in and password mails - stay aethercert's and are always sent by us.
Add a square favicon under MSP > Branding: it is what a customer gets when they add the dashboard to their home screen, along with your company name.
Timing and retention
| Free | Standard | Pro | MSP | MSP Plus | |
|---|---|---|---|---|---|
| Idle check-in interval | 3h, fixed | 1-3h, configurable | 30 min-3h, configurable | 1-3h, configurable | 1-3h, configurable |
| Event log retention | 7 days | 30 days | 90 days | 90 days | 90 days |
| Agent local log retention | 7 days, fixed | Up to 30 days | Up to 90 days | Up to 30 days | Up to 30 days |
The idle interval is only the idle one. Whenever a job or an update is queued, the control plane shortens any agent's next check-in to roughly 10 seconds regardless of plan, so issuance is never held up by the cadence.
What happens at a limit
Limits are enforced by the server, not just by the interface, so a request that would exceed one is refused whatever sent it.
| Limit reached | What happens |
|---|---|
| Certificate, agent or domain count | Creating the next one is refused with a message naming the limit. Existing objects are untouched and keep renewing. |
| A capability you do not have | The control is visible but disabled, with an upgrade hint. Plan-restricted controls are never hidden, so you can always see what a plan would add. |
| A check-in interval outside your range | Rejected on save, with the allowed range in the message. |
| A log retention value above your cap | Rejected on save. A stored value that exceeds a newly lowered cap is clamped at read time instead, so a downgrade takes effect immediately without editing anything. |
Changing plan
Upgrading applies immediately to your existing organization. Agents, domains and certificates carry over; nothing is re-created, and no agent needs reinstalling.
Downgrading does not delete anything. What exceeds the new plan's limits keeps working and keeps renewing; you simply cannot create more until you are back under. The capability restrictions, though, do apply from the moment the plan changes:
- A deploy target the lower plan does not allow will fail validation on the next edit or reissue of the certificate that uses it.
- Configurable values above the new cap are clamped rather than rejected - see log retention above.
The one thing to plan for is Free, which allows only Let's Encrypt and EC-256. A certificate on another authority or key type will not reissue on Free.
Reading the limits in the product
Two places show them:
- Settings > Organization > Billing shows your current plan and usage against each limit.
- Each form disables what your plan does not allow, with the reason.