One price a year, and nothing per certificate

One certificate is one common name plus its alternative names, however many servers it is installed on. A certificate covering example.com and www.example.com, deployed to twelve servers, counts as one - not twelve.

Count the servers that need a certificate and the domains they sit under. Free is one of each, for trying it out. Standard covers 150 certificates across 75 servers and 5 domains, which is more than most single companies ever use, and it has every capability the product has. Pro exists for when those numbers are not enough. MSP is for managing other companies' infrastructure rather than your own.

Scale and monitoring, not core capability. Standard already includes every certificate authority, every place a certificate can be installed, agent groups, certificate policies and exportable keys. Pro raises the ceilings to 1,500 certificates and 1,000 agents, lets agents check in as often as every 30 minutes instead of Standard's 1-hour floor (both still default to 3 hours), keeps 90 days of history instead of 30, and adds the integrations that push fleet metrics and alerts into a monitoring system you already run.

Creating the next certificate, agent or domain is refused with a message naming the limit. Nothing that already exists is affected - it keeps working and keeps renewing. Capabilities your plan does not include are shown as disabled controls with an upgrade hint rather than hidden, so you can always see what a plan would add.

Yes. Upgrading applies immediately - agents, domains and certificates carry over, nothing is re-created and no agent needs reinstalling. Downgrading deletes nothing either: whatever exceeds the new limits keeps working and keeps renewing, you simply cannot create more until you are back under. The one thing to plan for is Free, which allows only Let's Encrypt and EC-256 keys, so a certificate on another authority will not reissue there.

No, the Free plan requires no payment details at all. It covers one certificate on one server for one domain using Let's Encrypt - enough to run the whole cycle end to end on a real machine before deciding anything. Registration itself is invite-only while we scale, so sign-up starts with a short waitlist.

No - all paid plans are billed annually. That keeps the price per certificate low and avoids monthly billing overhead on both sides. Prices exclude applicable taxes.

Through Stripe's customer portal, reachable from Settings › Organization › Billing. Payment methods, invoices, receipts and cancellation are all handled there.

Stripe retries on its normal schedule and the failure is recorded in your event log. Certificates already installed keep working throughout - they are files and certificate-store entries on your own servers with no runtime dependency on aethercert.

Yes - that is what the MSP plan is for. Each customer gets a fully separate workspace with its own data and its own access, you work across all of them from one login and one invoice, and you decide independently what to charge each customer.

The MSP plan includes five Standard-tier customer places. Additional Standard or Pro places are bought from the dashboard at a discounted rate. Each is its own annual subscription with its own renewal date and its own auto-renew switch - assign one to a customer, reassign it to a different one later, or let it lapse when the relationship ends.

Yes. Each one is its own organization - separate data, separate access - not a shared tenant filtered by a customer ID. Managing ten customers means ten isolated organizations, and there is no query that spans them.

The workspace drops to Free-plan limits rather than being deleted. Nothing is destroyed, certificates already installed keep working, and the data is still there if the customer comes back. The licence can then be assigned to someone else.

They keep it. Their tier, renewal date and invoice stay theirs when you take over managing them, and they do not consume one of your places. If a managed customer buys their own subscription later, that takes over and the licence you had assigned is released back into your pool.

You do - that is what they are paying you for, and a customer workspace's own support screen points its users at your contact details rather than at aethercert. As an MSP you are a direct aethercert customer, so support for you comes from us directly.

No. Every private key is generated on the server that will serve the certificate, by the agent, and never leaves that host. What comes back to us is metadata - serial number, fingerprint, validity window. This is true on every plan, including Free.

They keep working. Installed certificates are ordinary files and certificate-store entries on your own servers with no runtime dependency on us. What pauses is scheduling, so renewals resume when the control plane is reachable again - and the default 30-day renewal window is the margin that makes a short outage a non-event.

Storage and processing stay in Germany: the application runs on Hetzner in Nuremberg and the database on Supabase in Frankfurt (eu-central-1). Cloudflare sits in front as a TLS-terminating proxy for DDoS protection - it handles edge traffic, not data storage.

217, on every plan including Free. That covers Cloudflare, Route 53, Azure, Google Cloud, DigitalOcean, Hetzner and every other common provider, and includes ACME-DNS, a generic webhook and a custom script as escape hatches for anything not on the list.

Not today. Certificates can currently be installed into Windows roles (certificate store, IIS, Exchange, ADFS, RDP/RDS listener, RDS deployment, WinRM, SQL Server, Skype for Business/Lync, Hyper-V Replica), Linux services (NGINX, Apache, custom paths with a reload command), Citrix NetScaler/ADC, Docker containers, and custom scripts on either operating system - the full list is in the comparison table above.

Not yet. The dashboard and the agents talk over an internal API today, and a documented public API for external integrations is on the roadmap. On Pro and MSP there is a read-only metrics endpoint in Prometheus format, which covers monitoring but not automation. If a public API is a blocker for you, say so - that is what moves it.

Your account profile and organization memberships, yes, as JSON from account settings. Self-service export of certificates and the full event log is not built yet - ask if you need it for a specific compliance requirement.

Not a tiered SLA today. aethercert is built and supported by one person, so support means a direct reply rather than a ticket queue with a response-time table. Security reports do have committed timelines - three business days to acknowledge, ten to assess.