Plans and limits
What each aethercert plan allows: certificate, agent and domain counts, authorities, deploy targets, key types, check-in cadence and retention windows - plus billing intervals and what happens when a plan changes or ends.
Five plans: Community, Standard, Pro, MSP and MSP Plus. This page is the technical matrix - what each one allows, how each is billed, and what happens when you reach a limit or move to a smaller plan.
Limits are enforced by the server, not just by the interface, so a request that would exceed one is refused whatever sent it.
Community is for homelabs and small businesses that are too small for a full certificate lifecycle management product: every Target Registry deploy target, Let's Encrypt, and a single user. It has no enterprise features - no CA connectors or other authorities, no custom scripts, no agent groups or policies, no monitoring integrations.
Capacity
| Community | Standard | Pro | MSP | MSP Plus | |
|---|---|---|---|---|---|
| Certificates | 2 | 150 | 1,500 | 150 | 150 |
| Agents (servers) | 2 | 75 | 1,000 | 75 | 75 |
| Domains | 1 | 5 | 25 | 5 | 5 |
| Users | 1 | Unlimited | Unlimited | Unlimited | Unlimited |
| Mail apps | 1 | 3 | 10 | 5 | 5 |
| Customer workspaces | - | - | - | 5 included, more on demand | 5 included, more on demand |
MSP's and MSP Plus's own numbers are Standard's. They govern the reseller organization's own workspace; each customer workspace runs on the tier of the slot assigned to it - or of its free proof of concept - and gets that tier's numbers.
A customer who pays for their own Standard or Pro subscription keeps it when an MSP takes over managing them, and does not use one of the included places. A Community organization can only come under an MSP's management when the MSP licenses it as Standard or Pro. See MSP customer workspaces.
Capabilities
| Community | Standard | Pro | MSP | MSP Plus | |
|---|---|---|---|---|---|
| Certificate authorities | Let's Encrypt only | Any, including your own internal or private CA | Any | Any | Any |
| Target Registry deploy targets | All | All | All | All | All |
| Custom-script deploy targets | No | Yes | Yes | Yes | Yes |
| CA connectors (AD CS) | No | Yes | Yes | Yes | Yes |
| Agent groups and certificate policies | No | Yes | Yes | Yes | Yes |
| Key types | EC-256 only | All four | All four | All four | All four |
| DNS providers | All 217 | All 217 | All 217 | All 217 | All 217 |
| Monitoring integrations and metrics API | No | No | Yes | Yes | Yes |
| Email notifications | Yes | Yes | Yes | Yes | Yes |
| Roles, MFA, passkeys, SSO | Yes, on every plan | ||||
| Reseller: customer workspaces, slots, sharing | No | No | No | Yes | Yes |
| White-label branding and custom dashboard domain | No | No | No | No | Yes |
MSP Plus is MSP plus white labeling and nothing else. Every capacity number above is deliberately identical between the two tiers.
Timing and retention
| Community | Standard | Pro | MSP | MSP Plus | |
|---|---|---|---|---|---|
| Idle check-in interval | 8h, fixed | 1-3h | 30 min-3h | 1-3h | 1-3h |
| Event log and job retention | 7 days | 30 days | 90 days | 90 days | 90 days |
| Agent local log retention | 7 days, fixed | Up to 30 days | Up to 90 days | Up to 30 days | Up to 30 days |
Community checks in every 8 hours, fixed. The paid plans default to a 3-hour idle interval and can only dial it faster, down to their own floor, never slower. And the idle interval is only the idle one: whenever a job or an update is queued, the control plane shortens any agent's next check-in to 10 seconds regardless of plan, so issuance is never held up by the cadence.
CA connectors and certificate connectors follow the same idle interval and the same per-plan range as agents. A certificate connector with queued orders checks in every 10 seconds until they are picked up, and a failed order step that is waiting to be retried brings it back when the retry is due.
What happens at a limit
| Limit reached | What happens |
|---|---|
| Certificate, agent, domain or mail app count | Creating the next one is refused with a message naming the limit. Existing objects are untouched and keep renewing - after a move to a smaller plan, see when a plan shrinks. |
| Users on Community | Inviting anyone is refused - Community has a single user. Members that joined before a downgrade keep their access. |
| A capability you do not have | The control is visible but disabled, with an upgrade hint. Plan-restricted controls are never hidden, so you can always see what a plan would add. |
| A check-in interval outside your range | Rejected on save, with the allowed range in the message. |
| A log retention value above your cap | Rejected on save. A stored value that exceeds a newly lowered cap is clamped at read time instead, so a downgrade takes effect immediately without editing anything. |
Billing
Community is free. Standard and Pro can be paid annually or monthly; MSP and MSP Plus are annual only.
| Annual | Monthly | |
|---|---|---|
| Standard | €590 / year | €59 / month |
| Pro | €1,390 / year | €139 / month |
| MSP | €2,190 / year | - |
| MSP Plus | €3,490 / year | - |
Prices exclude VAT. The monthly price is the annual price plus 20%, spread over twelve months, so paying annually saves about 17% over a year. Payment methods, invoices and cancellation are handled through Stripe's customer portal, reached from Settings > Organization > Billing.
Changing plan
| Change | When it takes effect |
|---|---|
| Upgrade | Immediately, prorated for the rest of the current period. |
| Monthly to annual | Immediately, prorated. |
| Downgrade to a cheaper paid plan | At the end of the period already paid for. Until then, the billing page offers to cancel it. |
| Annual to monthly | At the end of the period already paid for. |
| Cancellation | At the end of the period already paid for, through Stripe's portal. The workspace then runs on Community. |
A higher plan on a shorter interval in one step is not possible. Upgrade first, then switch the interval at renewal.
Upgrading carries everything over: agents, domains and certificates stay as they are, nothing is re-created, and no agent needs reinstalling. An upgrade also lifts any renewal limit from a previous smaller plan the moment it applies.
Two restrictions apply as soon as a smaller plan takes effect:
- A deploy target the lower plan does not allow fails validation on the next edit or reissue of the certificate that uses it.
- Configurable values above the new cap are clamped rather than rejected - see log retention above.
When a plan shrinks
This applies whenever a workspace ends up on a smaller plan: a downgrade taking effect, a monthly or annual plan ending without auto-renew, a cancellation, or an MSP licence or proof of concept ending. Nothing is ever deleted.
| What happens | |
|---|---|
| The first 14 days | A grace period. Everything keeps working and keeps renewing as before. |
| After the grace period | Only as many certificates renew automatically as the new plan allows - the oldest first - and only on certificate authorities and key types the plan includes. On Community that means Let's Encrypt with EC-256 keys. |
| Certificates beyond that | Stay installed and valid until they expire. Configuration, agents and domains are untouched. |
| Monitoring integrations | On a plan without them, the metrics endpoint and webhook, syslog and SNMP push pause after the grace period. Their configuration is kept, and they resume on upgrade. |
| Creating new resources | Refused beyond the new plan's limits, as on any plan. |
You decide which certificates stay inside the plan: turn auto-renew off on the ones you no longer need, and the next oldest move into the plan in their place. An upgrade lifts the limit immediately.
The dashboard warns you ahead of time. A notice appears before a plan ends without auto-renew - 7 days before on monthly billing, 30 days before on annual - when a scheduled plan change is near, and for as long as certificates are outside the plan.
Where to see your usage
Settings > Organization > Billing shows the current plan and usage against each limit. Every form disables what your plan does not allow, with the reason.