Agent overview
The five binaries aethercert installs on a host - fleet agent, CA connector, Update Service, tray and installer - what each one does, and where to start.
Five binaries make up a host-side installation. In normal use you download and run one of them - the installer - with the command the dashboard hands you, and it takes care of the rest.
| Binary | Runs as | What it does |
|---|---|---|
aethercert-installer | one-shot, elevated | Installs, repairs and removes everything else. A graphical wizard on Windows when started with no arguments. |
aethercert-agent | LocalSystem service, or root under systemd | Polls the control plane, issues certificates, deploys them locally. |
aethercert-ca-connector | Windows service | Fronts an internal CA - in practice Active Directory Certificate Services - with the REST contract agents already speak. |
aethercert-update-service | LocalSystem service, or root under systemd | The only thing that replaces the other binaries. |
aethercert-tray | user session, Windows only | Tray icon: check for updates, open logs, sync now. |
Every component reports the same version scheme, YEAR.MONTH.VERSION.FIX.HOTFIX, and
each is versioned independently.
What the agent actually does
On a schedule it opens one outbound HTTPS connection to the control plane and asks whether there is work. If there is, it claims the job, generates a fresh private key and CSR locally, proves control of the hostname, obtains the certificate, installs it into the configured deploy target, and reports back serial, fingerprint and validity.
The private key never leaves the host. Nothing in this software uploads key material, logs it, or puts it in an error string.
The agent accepts no inbound connection. The only component that listens is the CA connector, and only on your internal network.
Where to start
Installing the agent
The one-command install, the graphical setup, and what it does to the host.
Unattended rollout
Golden images, cloud-init, configuration management, Group Policy.
Updates and release channels
How a host gets a new build, and how to pin or canary one.
The CA connector
Active Directory Certificate Services, the rights it needs, and its health checks.
CLI reference
Every command and flag on all four command-line binaries.
File locations
Binaries, configuration, logs, scripts and services, per platform.
What is configured where
Almost everything about an agent's behaviour lives in the dashboard, not on the host: check-in cadence, preferred challenge type, network stack, update channel, log retention. See Agents for those.
Only three things are local to the host, and they live in the agent's config.json: the
control plane URL, its credentials, and two settings that tune the local certificate
scan. See Agent configuration.