| ACME | Automatic Certificate Management Environment (RFC 8555) - the protocol a client uses to prove control of a hostname and obtain a certificate with no human in the loop. Let's Encrypt popularised it; most public CAs now support it. |
| CA (certificate authority) | The party that signs certificates. Public CAs are trusted by browsers and operating systems out of the box; a private or internal CA is trusted only by machines you configured to trust it. |
| Chain / intermediate | The certificates between your leaf certificate and the CA's root. A server must serve the chain, or clients that lack the intermediate will reject an otherwise valid certificate. |
| CSR (certificate signing request) | A signed request containing the public key and the identities being requested. The private key stays with whoever generated the CSR - in aethercert, always the agent. |
| CT (certificate transparency) | Public, append-only logs that publicly trusted certificates are recorded in. Every public certificate you issue is therefore discoverable, hostnames included. Certificates from a private CA are not logged. |
| DNS-01 | The validation method that proves control of a hostname by publishing a TXT record under _acme-challenge. The only method that can issue wildcards, and the only one that works for hosts which are not publicly reachable. aethercert publishes and removes the record when a DNS provider is connected. |
| EAB (external account binding) | A key ID and HMAC key, generated in a CA's own dashboard, that ties an ACME account to your account there. Most public CAs other than Let's Encrypt require one. aethercert cannot generate them - they are proof that you control an account at that CA. |
| HTTP-01 | The validation method that proves control of a hostname by serving a token at http://<host>/.well-known/acme-challenge/<token>. Needs the host reachable from the internet on port 80, and cannot issue wildcards. |
| Key type | The algorithm and size of the private key: EC-256, EC-384, RSA-2048 or RSA-4096. EC-256 is the default and is correct almost everywhere; RSA is for targets that explicitly require it. |
| Leaf certificate | The certificate for your actual hostname, as opposed to the intermediates and root above it in the chain. |
| Not before / not after | The start and end of a certificate's validity window. "Expiry" means the not-after date. |
| Revocation | Telling the CA that a certificate should stop being trusted before it expires, usually because its key may have been exposed. Distinct from deleting it in aethercert, which only stops managing it. |
| SAN (subject alternative name) | An additional hostname on the same certificate. Modern clients validate against the SAN list rather than the common name, so a certificate covering two names carries both. |
| Wildcard certificate | One covering every direct subdomain of a name: *.example.com matches a.example.com but not a.b.example.com. Requires DNS-01 validation. |