aethercert
Certificate authorities

Automated commercial certificates from PSW Group

For certificates that have to come from a commercial authority, aethercert places and follows PSW Group orders - for the products your PSW account can order - through a certificate connector that runs on your own server. The private keys never leave it.

Get started free Read the documentation

At a glance

Connector
Windows service or systemd unit on your server; outbound to aethercert and PSW Group
Key storage
Encrypted local key store (DPAPI-protected on Windows); nothing secret in the cloud
Key release
Single-use, job-bound token per agent; optional strict allow-list
Environments
PSW Group sandbox and production

What it does

The certificate connector generates the key and CSR locally, places the order with PSW Group, follows validation and issuance, and stores certificate and key in an encrypted local key store. aethercert's cloud never talks to PSW Group and never sees a key.

When a certificate is ready, agents fetch it from the connector over your internal network with a short-lived, single-use token, and deploy it like any other certificate. In strict mode, the connector only releases keys to agents you approved on that host. Because the key lives on the connector, one certificate can be shared by every member of an agent group.

How it runs

  1. 01

    Order

    The connector creates key and CSR and places the order with PSW Group, idempotently.

  2. 02

    Validate

    Validation data is shown in the dashboard; the connector polls the order until it is issued.

  3. 03

    Store

    Certificate and key are stored encrypted on the connector host.

  4. 04

    Release and deploy

    Agents fetch the material with a single-use token and run their deploy targets.

What you configure

  • PSW Group client ID and secret, sandbox or production (stored encrypted, released to the connector just in time)
  • PSW product, from the list your account can order
  • Optional strict mode: approved agents per connector

Prerequisites

  • A PSW Group account with API access
  • A Windows or Linux server for the certificate connector, reachable by your agents

Limitations

  • Orders are billed by PSW Group.
  • Some products require manual validation or review at PSW Group before issuance.

Related features

Automated renewalRenew on schedule from ACME, AD CS or a commercial CA.Certificate policiesOne rule issues a certificate for every server in a group.Certificate deploymentInstall renewed certificates into IIS, Exchange, NetScaler and other targets.

Solutions

Enterprise ITSSO, roles, audit, SIEM and AD CS across a large estate.Managed service providersSeparate customer workspaces, wholesale licences, your branding.

More in Certificate authorities

ACME certificate authoritiesLet's Encrypt, Google Trust Services, ZeroSSL, SSL.com, Actalis, step-ca.Active Directory Certificate Services (AD CS)Issue from your AD CS templates through a connector on the CA.

All integrations

Documentation

Automate PSW Group

Connect it once in the dashboard; every issuance and renewal uses it from then on.

Get started free All integrations

Community plan, no card required. Open registration - your account is ready in a few minutes.