Add PSW Group
PSW Group is a commercial certificate reseller. Unlike the ACME authorities, aethercert talks to its ordering API: it submits the CSR your agent generated, then polls the order until the certificate is issued.
Every certificate is a real purchase
PSW orders are billable at PSW. A per-agent certificate policy therefore places one order per server - including for every server that joins the group later. Start in the sandbox environment and move to production deliberately.
1. Create API credentials
Open the right console
Sandbox: test-console.psw-group.de. Production: your PSW Group console at psw-group.de.
They are separate systems with separate credentials. Credentials from one do not work against the other.
Create an application
Go to Configuration > API and create an application. Copy its client ID and client secret.
2. Connect it in aethercert
Add the authority
Go to Manage > Certificate Authorities and click Add certificate authority. Set Type to PSW Group (paid reseller).
Choose the environment
Sandbox (test-api.psw-group.de) or Production (api.psw-group.de). Sandbox
is the default, and is where you should start.
Paste the credentials
Client ID and client secret, matching the environment you selected. Name the authority so the environment is obvious from the list - orders placed against the wrong one are the mistake this naming prevents.
The secret is stored encrypted and never returned to the browser. Leave the field empty when editing to keep the stored value.
3. Order a certificate
Select this authority under Build > Certificate Job. One extra field appears:
| Field | What it does |
|---|---|
| PSW product | Which product to order. The list is fetched live from PSW using your credentials, so it reflects what your account can actually buy. |
Everything else is the same as any other certificate: the agent generates the key and CSR locally, and the key never leaves that host.
What happens after you save
Issuance is not immediate, and this is the main practical difference from ACME.
- aethercert submits the order with the agent's CSR.
- PSW may require domain validation - by email, HTTP, CNAME, DNS TXT or meta tag, depending on the product - and some products involve manual review.
- aethercert polls the order every three minutes. The certificate's detail sheet shows the order's validation state and counts down to the next poll.
- Once PSW issues, the certificate is deployed and renewal is scheduled as normal.
So a job sitting in a pending state here is usually correct behaviour, not a failure. Check the validation state on the certificate before treating it as one.
Policies and PSW
A certificate policy using a PSW authority must be in per-agent mode. Shared mode is not available, because a single certificate shared across several agents would have them overwrite each other's order state - PSW tracks one order per certificate.
The consequence is the billing one at the top of this page: one order per member, now and for every member that joins later. The policy form states this explicitly before you save.
Revocation
PSW revocation is a server-side API call rather than something an agent does. A policy set to retire therefore stops a PSW certificate renewing but does not revoke it - do that at PSW by hand if it is needed.