Quickstart

This is the whole path from a new account to a certificate that installs itself and renews on schedule. On a single server it takes about ten minutes, most of which is waiting for a DNS record to propagate.

1. Create an account

Sign-up is invite-only. You need one of two things:

• An invite code. Enter it with your email address and password on the sign-up form. A code is single-use and is consumed the moment it is accepted, so redeem it with the address you intend to keep. Without a code, join the waitlist on the same page.
• An invitation to somebody else's organization. When a colleague invites an address that has no account yet, that invitation also clears the sign-up gate. Sign up with the invited address and no code is needed.

Passwords need at least 8 characters, an uppercase letter, a lowercase letter, a number and a special character. Both the form and the server check this.

Every session is multi-factor, with no way to switch that off, so enrolling an authenticator app is part of signing up rather than a later step. See Roles and permissions.

The first screen

An account that belongs to no organization lands on the onboarding screen, which offers whichever of these two apply:

• Accept an invitation that is already waiting for your address. You then work in that organization and create nothing of your own.
• Create an organization. It asks for a name, then a contact name, email, phone, street address, city and postal code. All of them are required - billing and support need somewhere real to reach before anyone visits the settings page.

Everything you create from then on - domains, agents, certificates - belongs to that organization.

2. Install an agent

The agent holds the certificate, so it goes on the server that will serve it.

Go to Manage > Agents and start a new agent. The wizard has three sections:

1. Platform - operating system, whether you want the graphical setup or the command line, a single-provision or multi-provision token, and optionally the agent group the host should join.
2. Installation - the enrollment token is minted when you reach this section, and the wizard shows the download and the install command with the token already in it.
3. Verify - the wizard polls for the agent's first check-in.

The Linux command it gives you looks like this:

curl -fsSL https://cdn.aethercert.com/install.sh \
  | sudo sh -s -- --token <token> --api https://api.aethercert.com

and the Windows one, from an elevated PowerShell:

& ([scriptblock]::Create((irm https://cdn.aethercert.com/install.ps1))) `
  -Token '<token>' -Api 'https://api.aethercert.com'

Either one downloads aethercert-installer, compares it against its published SHA-256 before executing it, enrolls the host, installs the agent as a service and starts it. Every other install case - the graphical setup window, containers, unattended fleet rollout - is in Installing the agent.

The agent polls outbound, so Verify works from behind NAT and a closed inbound firewall.

3. Add and verify a domain

Go to Manage > Domains and add the domain the certificate will cover. aethercert gives you a _aethercert-challenge TXT record to publish at your DNS host; once it resolves, press Verify. This is a one-time step per domain, and it is separate from the ACME challenge that happens at issuance.

On the same screen you can connect a DNS provider. That is optional, and it decides which validation methods are open to you:

• Without a DNS provider, certificates are validated over HTTP-01 or TLS-ALPN-01. The hostname must be reachable from the internet on port 80 or 443 at issuance time, and wildcard certificates are not possible.
• With a DNS provider connected, DNS-01 becomes available. aethercert creates and removes the challenge records itself, wildcards work, and the hostname does not have to be publicly reachable at all.

There are 217 providers to choose from. See Domains and DNS validation.

4. Choose a certificate authority

Every organization is seeded with a Let's Encrypt entry that needs no configuration, so there is nothing to do here unless you want a different authority.

If you do, add it under Manage > Certificate Authorities first - another public ACME CA, the PSW Group reseller, or your own internal CA. See Certificate authorities.

5. Create the certificate

Go to Build > Certificate Job and fill in four things:

1. The identity - the common name, plus any subject alternative names. With a domain selected you enter only the label (app) and the domain is appended.
2. The authority - from step 4.
3. The deploy target - what the agent does with the certificate once it has it: import it into the Windows certificate store, write it to disk and reload NGINX, upload it to a load balancer. See Deploy targets.
4. The target - the agent from step 2.

Save, and the issue job is queued. Whenever work is waiting, the control plane shortens the agent's next check-in to 10 seconds, so it starts within a few seconds rather than after the idle interval.

6. Confirm it renews itself

Open the certificate from Manage > Certificates. Auto-renew is on by default, and the renewal is queued a configurable number of days before expiry - 30 by default.

From here nothing needs a person. The control plane tracks the expiry date and queues the renewal job, the agent generates a fresh key and reissues, and every attempt lands in the event log.

Next

Rolling this out beyond one server changes the shape of the work: instead of creating one certificate per host, you write the rule once and let the fleet grow into it.