aethercert Toolkit - free certificate utility for Windows

The aethercert Toolkit is a free certificate utility for the certificate work that happens on a single Windows machine: create a CSR, import the certificate the CA sends back, export it as .pfx or PEM, sign an executable, and find every TLS certificate on your internal network. It is in the spirit of the DigiCert Certificate Utility and runs entirely locally - no account, no telemetry, nothing uploaded.

It is a standalone tool. You do not need an aethercert subscription, an agent or the dashboard to use it. The product page is at aethercert.com/tools/certificate-utility.

What the certificate utility doesCopy Anchor Link

Every tool is also a subcommand of the command-line program actk (which writes keys to files, not to the Windows key store) - see the CLI reference. The desktop app is in English and German (it follows the Windows display language and can be switched in Settings), in light and dark.

RequirementsCopy Anchor Link

DownloadCopy Anchor Link

The current version is 1.1.2.

The setup language is the only difference between the English and the German MSI; the app itself switches between both languages either way. Windows Server 2019 and 2022 ship without WebView2 - on a server that cannot reach the internet, use the offline installer. Both installers set up the same app and replace each other.

Each file also has a .sha256 file beside it. The links above always point to the latest release; every version stays available under its own folder, for example https://cdn.aethercert.com/tools/toolkit/1.1.2/.

The examples in these pages call the command line actk. Save actk-windows-amd64.exe as actk.exe in a folder on your PATH.

Verify the downloadCopy Anchor Link

The installers and actk are Authenticode-signed. Check the signature and the checksum before you run them on a server:

$file = 'aethercert-toolkit-windows-amd64-en-US.msi'
Get-AuthenticodeSignature .\$file | Format-List Status, StatusMessage, SignerCertificate

Invoke-WebRequest "https://cdn.aethercert.com/tools/toolkit/latest/$file.sha256" -OutFile "$file.sha256"
$expected = (Get-Content "$file.sha256" -Raw).Split(' ')[0]
(Get-FileHash .\$file -Algorithm SHA256).Hash -eq $expected

Status should be Valid and the last line should print True. The signature tells you who published the file; the checksum comes from the same server, so it only proves the download is complete. The comparison ignores case, so the lower-case checksum file and the upper-case Get-FileHash output match.

Install and first startCopy Anchor Link

1. Double-click the MSI and confirm the UAC prompt. Setup installs the app for all users and adds aethercert Toolkit to the Start menu; if WebView2 is missing, it installs that too.
2. If Windows protected your PC appears, choose More info, then Run anyway. SmartScreen shows this for a new release until it has built up download reputation; a valid signature does not suppress it on day one. See Troubleshooting.
3. Start aethercert Toolkit from the Start menu. The app opens on Certificates, the list of your personal certificates. Create CSR, Check CSR, Import and Convert files open from the buttons above the list; Sign code, Certificate scanner, Security scan and Settings are in the sidebar.

To install without dialogs, for example from a software distribution tool:

msiexec /i aethercert-toolkit-windows-amd64-offline-en-US.msi /qn

The app runs as the signed-in user. The Computer store of the certificate list is read-only until you choose Restart as administrator there - the toolkit then restarts elevated (one UAC prompt) and opens on the computer store. You need that to import a certificate for IIS, RDP, LDAPS or Exchange, to delete one, or to export a computer certificate with its private key.

UpdatesCopy Anchor Link

The toolkit does not update itself and does not check for updates - it makes no network connection you did not start. To update, download the new version and run its installer; it replaces the installed version and keeps your settings. To remove the toolkit, uninstall aethercert Toolkit under Settings > Apps. What changed is in the release notes.

Where settings are keptCopy Anchor Link

The desktop app saves its settings in %APPDATA%\com.aethercert.toolkit\settings.json: language, theme, sidebar, scan settings, the trusted-CA settings, the subject fields the next CSR starts with (organization, city, state, country, key type), and the open certificate requests - for each request only where its key is (a container name in the Windows key store or a file path), never the key itself. Delete the file to reset the app.

Next stepsCopy Anchor Link

• New certificate for a server: Create CSR, then import the issued certificate.
• Certificate to move to nginx or an appliance: export it or convert the files.
• What expires in your network: Certificate scanner.
• How the toolkit treats private keys: Privacy and security.