FAQ

Operational questions and their answers. If something is failing rather than merely unclear, start at Troubleshooting.

Certificates

Which key type should I use?

EC-256 is the default and is correct almost everywhere. Use RSA-2048 or RSA-4096 only when a target explicitly requires RSA - some appliances and older Windows integrations do. RSA keys are larger and slower to generate, with no security benefit over EC-256 on current software.

Can I issue wildcard certificates?

Yes, with DNS-01 validation, which means a DNS provider connected to the domain. Wildcards cannot be issued over HTTP-01 or TLS-ALPN-01. That is an ACME rule, not an aethercert limitation.

Note that *.example.com matches a.example.com but not a.b.example.com. Nested subdomains need their own wildcard.

Can I move a certificate from one agent to another?

No. Certificates are not re-targeted in place. Delete it and create a new one against the other agent.

If several servers need the same certificate, use an agent group rather than moving one repeatedly.

What is the difference between deleting and revoking?

Revoking asks the authority to stop trusting the certificate before it expires - use it when a key may have been exposed. Deleting removes the record from aethercert; the certificate keeps working wherever it is installed until it expires. Neither reaches onto the host to remove a deployed file.

There is also Hide, which only removes a row from the list.

Does renewal keep the same key?

No. Every issuance, including every renewal, generates a fresh key and produces a new serial. Anything that pinned the old fingerprint has to stop doing that.

What are those "external" certificates in my list?

Certificates your agents found already installed on their hosts, whoever put them there. They are tracked read-only so their expiry dates stop being invisible - aethercert has neither their key nor their issuance configuration, so it cannot renew them. See External certificates.

Agents and networking

Does the agent send private keys to aethercert?

No. The key is generated on the host that will serve the certificate and never leaves it. The agent reports metadata only: serial, fingerprint, validity, and the outcome.

Do I need to open a firewall port?

No. The agent makes outbound HTTPS connections and accepts none, so it works behind NAT and a closed inbound firewall. The only component that listens is the optional CA connector, and only on your internal network.

The exception is a certificate validated with HTTP-01 or TLS-ALPN-01 without a webroot, where the CA has to reach port 80 or 443 during issuance. See Network requirements.

Can the agent run in a container?

Yes. Enroll and run it in the foreground rather than installing a service. It gets no automatic updates that way, so rebuild the image on a new version. See Containers.

How do I roll out hundreds of agents?

One multi-provision token and the same install command, run by whatever already provisions your servers - a golden image, cloud-init, Ansible, Group Policy. Pick an agent group when generating the token and every host arrives in that group, so a certificate policy on it applies before the first check-in.

A token expires an hour after it is created and is capped at 500 uses, so mint it inside the rollout rather than baking one into an artifact. See Unattended rollout.

Do I have to create the agents before the certificate?

No. Create the group, write the policy on it while it is still empty, then roll agents out. Each gets its certificate as it joins.

Availability and failure modes

What happens to my certificates if aethercert is unavailable?

Certificates already deployed keep working. They are ordinary files and store entries on your own servers, with no runtime dependency on aethercert - nothing phones home to validate them.

What pauses is scheduling: new issuance and renewals resume when the control plane is reachable again. The default 30-day renewal window is the margin that makes a short outage a non-event. Current availability is at status.aethercert.com.

What if a renewal fails?

It retries automatically, up to three attempts in total, then the job is marked failed and shows the error. With the default 30-day window that leaves a month to notice and fix it before anything expires - which is the reason not to shorten that window.

A failure the agent classifies as permanent, such as bad credentials on a deploy target, stops immediately rather than using up the remaining attempts.

Integrations

Which DNS providers are supported?

217 - the full lego provider set. Cloudflare, Route 53, Azure, Google Cloud, DigitalOcean, Hetzner and every other common one, plus ACME-DNS, a generic webhook and a script on the agent host as escape hatches. See Domains and DNS validation.

Which certificate authorities are supported?

Let's Encrypt out of the box; Google Trust Services, ZeroSSL, SSL.com and Actalis through EAB; PSW Group as a reseller; any ACME-speaking server including your own; and internal CAs over REST or through the AD CS connector. See Certificate authorities.

Is there an API?

There is one machine-facing endpoint: the Prometheus-format monitoring API, authenticated with a key you issue and available on Pro and the MSP tiers. For event-driven integration in the other direction there are webhook, syslog/CEF and SNMP-trap push integrations.

Everything else the dashboard does runs over an internal API that is not documented for third-party use. A general public API is not available today - if it is a blocker, say so, since that is what moves it.

Can I connect an internal CA that is not AD CS?

Yes. If it speaks ACME, point aethercert at its directory URL. If it has an HTTP endpoint that signs a CSR, use the Internal CA (REST) type - the request and response shapes are documented on Certificate authorities. The CA connector is only needed for AD CS.

Access and accounts

How do I get an account?

Sign-up is invite-only. You need an invite code, or an invitation to an organization that already exists - which also clears the sign-up gate for a new address. Without either, join the waitlist on the sign-up page.

Can I turn multi-factor authentication off?

No. Every session is multi-factor: password plus authenticator code, a passkey, or Entra SSO in an organization that relies on its own Conditional Access policies.

Why can a member not create deploy targets?

Because a deploy target runs commands as root or LocalSystem on your agent hosts. Creating one is closer to a code deployment than to a certificate setting, so it needs the admin role. Members can issue and renew certificates freely using targets that already exist. See Roles and permissions.

Can I export my data?

Your profile and organization memberships, yes - Settings > Profile > Your data, as JSON, rate-limited to once an hour. Self-service export of certificates and the full event log is not built; ask if a specific compliance requirement needs it.

Where is aethercert hosted?

The application on Hetzner in Nuremberg, the database on Supabase in Frankfurt. Storage and processing stay in Germany. Cloudflare sits in front as a TLS-terminating proxy for DDoS protection - it handles traffic, not storage. See Security and data handling.

Where do I get support?

Help > Support in the dashboard. It routes to whoever is responsible for your account: aethercert directly if you are an MSP or a direct customer, or your MSP if your workspace is one they manage.