Agent overview
The binaries aethercert installs on a host - fleet agent, CA connector, certificate connector, Update Service, tray and installer - what each one does, and where to start.
Six binaries make up a host-side installation. In normal use you download and run one of them - the installer - with the command the dashboard hands you, and it takes care of the rest.
| Binary | Runs as | What it does |
|---|---|---|
aethercert-installer | one-shot, elevated | Installs, repairs and removes everything else. A graphical wizard on Windows when started with no arguments. |
aethercert-agent | LocalSystem service, or root under systemd | Polls the control plane, issues certificates, deploys them locally. |
aethercert-ca-connector | Windows service | Fronts an internal CA - in practice Active Directory Certificate Services - with the REST contract agents already speak. |
aethercert-cert-connector | Windows service or systemd unit | Orders certificates from a commercial provider (PSW Group) and keeps their private keys on this host. See the certificate connector. |
aethercert-update-service | LocalSystem service, or root under systemd | The only thing that replaces the other binaries. |
aethercert-tray | each signed-in user's session, Windows | Tray icon: the services' status, sync now, check for updates, open logs. |
Every component reports the same version scheme, YEAR.MONTH.VERSION.FIX.HOTFIX, and
each is versioned independently.
What the agent actually does
On a schedule it opens one outbound HTTPS connection to the control plane and asks whether there is work. If there is, it claims the job, generates a fresh private key and CSR locally, proves control of the hostname, obtains the certificate, installs it into the configured deploy target, and reports back serial, fingerprint and validity.
The private key never leaves the host. Nothing in this software uploads key material, logs it, or puts it in an error string.
The agent accepts no inbound connection. The only components that listen are the CA connector and the certificate connector, and only on your internal network. For certificates ordered through a certificate connector, the key is generated and held on the connector host and handed to the deploying agent end-to-end encrypted - it still never reaches aethercert.
Where to start
Installing the agent
The one-command install, the graphical setup, and what it does to the host.
Unattended rollout
Golden images, cloud-init, configuration management, Group Policy.
Updates and release channels
How a host gets a new build, and how to pin or canary one.
The CA connector
Active Directory Certificate Services, the rights it needs, and its health checks.
CLI reference
Every command and flag on all four command-line binaries.
File locations
Binaries, configuration, logs, scripts and services, per platform.
What is configured where
Almost everything about an agent's behaviour lives in the dashboard, not on the host: check-in cadence, preferred challenge type, network stack, update channel, log retention. See Agents for those.
Only three things are local to the host, and they live in the agent's config.json: the
control plane URL, its credentials, and two settings that tune the local certificate
scan. See Agent configuration.