Unattended rollout
Rolling the agent out to a fleet: multi-provision tokens, golden images, cloud-init, configuration management and Group Policy.
Nothing extra is needed for a fleet rollout. It is the same install command with a multi-provision token, run by whatever already provisions your servers.
The token
Generate a multi-provision token under Manage > Agents. One token, one command, up to 500 hosts. Each host that redeems it becomes its own agent, named from its own reported hostname rather than from a name you typed.
Pick an agent group in the wizard before generating the token, and every host arrives already in that group - so a certificate policy on it applies before the agent's first ordinary check-in. Write the policy first, on an empty group, and servers provisioned months later get their certificate on the way up.
Tokens expire after an hour
An enrollment token is valid for one hour from creation, whatever its use count. Mint it as part of the provisioning run - from an operator's session immediately before the run, or as a step in the pipeline - rather than baking one into an image.
A multi-provision token in an image is a secret in an image
It registers agents in your organization. Scope it to the rollout and do not reuse one indefinitely. Anything that can read the image can read the token.
The command
curl -fsSL https://cdn.aethercert.com/install.sh \
| sudo sh -s -- --token <token> --api https://api.aethercert.com& ([scriptblock]::Create((irm https://cdn.aethercert.com/install.ps1))) `
-Token '<token>' -Api 'https://api.aethercert.com'Both verify the download against its published checksum - and, where release signing is configured, against a detached Ed25519 signature - before executing anything. Keep that property in whatever you script yourself.
Pin a version with --version / -Version so an image build is reproducible. Without it,
the install tracks the current published build.
Per-approach notes
| Approach | How |
|---|---|
| Golden image | Bake the installer binary and the command into the image build. Pin a versioned CDN path so the image is reproducible. Mint the token at build time, since it will have expired long before the image is deployed - which means each build enrolls, not each boot. |
| cloud-init / user data | Add the one-liner as a runcmd step, with the token injected by whatever renders the user data. This is the shape that works best with the one-hour expiry. |
| Ansible, Puppet, Chef, DSC | Run the installer as an ordinary command resource, guarded by whether the service already exists. aethercert-installer status exits 0 either way, so it is safe as a check. |
| Group Policy / Intune | Deploy the installer and run it as a startup script with the token as an argument. |
A golden image enrolls once, not once per boot
An image baked with a completed install carries that one host's credentials. Every VM
cloned from it would then be the same agent. Either run the install on first boot -
cloud-init, a first-boot script - or bake only the binary and leave the install
command to first boot.
Waiting for the install on Windows
The Windows installer is a GUI-subsystem executable, so PowerShell and cmd.exe do not
wait for it. In a provisioning script that has to block:
Start-Process -Wait -NoNewWindow -FilePath .\aethercert-installer-windows-amd64.exe `
-ArgumentList 'install','--api','https://api.aethercert.com','--token','<token>'Piping its output also makes PowerShell wait.
Useful flags for a scripted install
| Flag | Why |
|---|---|
--quiet | Print warnings and failures only. |
--manual-start | Register the service without auto-start. |
--no-start | Register it without starting it now. |
--no-tray | Skip the tray icon on a headless Windows server. |
--no-update-service | Skip the Update Service. This host then never updates itself. |
--service-account / --service-password | Run the service as a named account instead of LocalSystem. |
--config <path> | An absolute path for config.json. Must be absolute; the installer rejects a relative one. |
--lang en|de | Language for the installer's own output. |
The full list is in the CLI reference.
Verifying a rollout
The dashboard's agent list is the reckoning: every host that redeemed the token appears there after its first check-in, with its hostname, version and last-seen time. An enrollment token's own page lists the agents that came from it, which is the quickest way to see whether 300 hosts became 300 agents.
On an individual host, aethercert-installer status prints what is installed and which
control plane it points at.