aethercert
01Connect

One command. Windows or Linux.

Paste one line into a terminal on the server. The agent connects out over HTTPS - no open ports, no VPN - and private keys never leave the server.

  • Outbound HTTPS only
  • No open ports
  • Private keys stay on the server
Linuxbash
curl -fsSL https://get.aethercert.com | sudo bash

The script asks for your enrolment token, checks it, and shows what it is about to do before it changes anything.

Unattended - token in the command

curl -fsSL https://get.aethercert.com | sudo bash -s -- --token <token>
WindowsPowerShell
irm https://get.aethercert.com | iex

Not running as Administrator? The script offers to restart itself elevated, then works the same way.

Unattended - token in the command

$env:AETHERCERT_TOKEN='<token>'; irm https://get.aethercert.com | iex

Where the token comes from

Every install needs an enrolment token. Create one in the dashboard under Manage › Agents › New agent - the dashboard then shows the unattended command with your token already filled in.

Open the dashboard Read the install guide
02Verify

What the script does

It is a short, readable script, and it does nothing to the server that it has not checked first.

  1. 01

    Checks the token first

    In an interactive run the token is checked with the control plane before anything is downloaded - a mistyped or expired token is caught right there.

  2. 02

    Asks before it changes anything

    Run without a token, it shows a short review of what will be installed and waits for your confirmation. If an agent is already installed, it offers to enrol it again, repair it or uninstall it.

  3. 03

    Verifies every download

    The installer is checked against its SHA-256 checksum and its Ed25519 release signature. A binary that fails either check is never run.

  4. 04

    Registers the service

    The agent is installed as a system service, started, and checks in with the dashboard. From there, certificates are managed centrally.

03Automate

Unattended and scripted installs

The same script runs in cloud-init, configuration management and CI. Without a terminal it cannot ask, so the token comes from the command or the environment.

LinuxWindowsWhat it does
--token <token>-TokenThe enrolment token. Also read from AETHERCERT_TOKEN.
--api <url>-ApiPoints the agent at another control plane. Also read from AETHERCERT_API.
--proxy <url>-ProxyAn HTTPS proxy for the script's own downloads, also written into the agent's configuration.
--version <ver>-VersionInstalls a specific published release instead of the current one.
-y, --yes-YesNever asks - for runs where nobody is there to answer.
-- <args>-InstallerArgsPasses further arguments straight to aethercert-installer.

Set NO_COLOR for plain output in logs.

On Windows, the parameters apply when the script runs as a script block - the form configuration management uses:

& ([scriptblock]::Create((irm https://get.aethercert.com/install.ps1))) -Token '<token>' -Yes

Read the script first

Both scripts are plain text at a fixed address, whatever client asks for them:

Frequently asked questions

Install

Is it safe to pipe a script into a root shell?

You can read the script at its fixed address before running it. It downloads the installer, verifies its SHA-256 checksum and its Ed25519 release signature, and refuses to run anything that fails either check. Run interactively, it changes nothing on the server until you have confirmed what it is about to do.

Which systems are supported?

64-bit Linux (linux/amd64) and 64-bit Windows (windows/amd64). The Linux script is plain POSIX sh, so on a system without bash, such as Alpine, pipe it to sudo sh instead.

Which firewall rules does the agent need?

Outbound HTTPS on port 443 only, to the install address, the download server and the aethercert API. Nothing needs to reach the server from outside.

What happens if an agent is already installed?

Run without a token, the script finds the existing agent and offers to enrol it again, repair it, uninstall it or cancel. Nothing happens until you choose.

Can I run it without a terminal?

Yes. In cloud-init, over ssh without -t or in a CI job, the script cannot ask for the token, so pass it with --token on Linux or the AETHERCERT_TOKEN environment variable on either system. That is the form the dashboard hands out.

No token yet?

Create a free account, add an agent, and the dashboard hands you the command with your token already in it.

Get started free Read the install guide

Community plan, no card required. Open registration - your account is ready in a few minutes.