One flat price, and nothing per certificate

One certificate is one common name plus its alternative names, however many servers it is installed on. A certificate covering example.com and www.example.com, deployed to twelve servers, counts as one - not twelve.

Count the servers that need a certificate and the domains they sit under. Community covers two certificates on two servers for one domain and one user - a homelab or a small business. Standard covers 150 certificates across 75 servers and 5 domains, which is more than most single companies ever use, and it has every capability the product has. Pro exists for when those numbers are not enough. MSP is for managing other companies' infrastructure rather than your own.

Scale and monitoring, not core capability. Standard already includes every certificate authority, every place a certificate can be installed, agent groups, certificate policies and exportable keys. Pro raises the ceilings to 1,500 certificates and 1,000 agents, lets agents check in as often as every 30 minutes instead of Standard's 1-hour floor (both still default to 3 hours), keeps 90 days of history instead of 30, and adds the integrations that push fleet metrics and alerts into a monitoring system you already run.

Creating the next certificate, agent or domain is refused with a message naming the limit. Nothing that already exists is affected - it keeps working and keeps renewing. Capabilities your plan does not include are shown as disabled controls with an upgrade hint rather than hidden, so you can always see what a plan would add.

Yes. Upgrading applies immediately and is prorated - agents, domains and certificates carry over, nothing is re-created and no agent needs reinstalling. A downgrade takes effect at the end of the period you have paid for and deletes nothing. For 14 days after that everything keeps working and renewing; then as many certificates keep renewing automatically as the new plan allows, oldest first, and only on the authorities and key types it includes - Community renews only Let's Encrypt with EC-256 keys. The rest stay installed and valid until they expire, and configuration, agents and domains are untouched. To choose which certificates stay inside the plan, turn off auto-renew on the ones you do not need. Monitoring integrations pause on plans that do not include them, with their configuration kept. The dashboard tells you before any of this applies, and an upgrade lifts the limit immediately.

Yes, for Standard and Pro: €59 and €139 a month, which is the annual price plus 20% spread over twelve months. Paying annually - €590 or €1,390 - saves about 17% over a year. MSP and MSP Plus are billed annually only. Prices exclude VAT.

Yes. A switch from monthly to annual applies immediately and is prorated, like an upgrade; a switch from annual to monthly takes effect at the end of the year you have paid for, like a downgrade. Moving to a higher plan and a shorter interval at the same time is not possible - upgrade first, then switch the interval at renewal.

Cancel in Stripe's customer portal and the plan runs until the end of the period you have paid for. After that the workspace moves to Community with nothing deleted, under the same 14-day grace period and rules as a downgrade. The dashboard reminds you before a plan ends without auto-renew: 7 days ahead on monthly billing, 30 days ahead on annual.

Stripe retries on its normal schedule and the failure is recorded in your event log. Certificates already installed keep working throughout - they are files and certificate-store entries on your own servers with no runtime dependency on aethercert.

Yes - that is what the MSP plan is for. Each customer gets a fully separate workspace with its own data and its own access, you work across all of them from one login and one invoice, and you decide independently what to charge each customer.

The MSP plan includes five Standard-tier customer places. Additional Standard or Pro places are bought from the dashboard at the plan price (€590 or €1,390 a year), with a volume discount from your 26th paid place: 5% from the 26th, 10% from the 51st, 20% from the 101st. The discount follows your current count - if you drop back to 25 places, the 26th pays full price again from its next renewal. Each is its own annual subscription with its own renewal date and its own auto-renew switch - assign one to a customer, reassign it to a different one later, or let it lapse when the relationship ends.

Yes. Put their workspace on a free 30-day proof of concept on Standard or Pro - no slot to buy, and none of your five included Standard places used. You can extend it once by another 30 days. Each customer workspace gets one trial, ever, and you can run up to three at the same time. Licensing the workspace with an included place or a slot converts the trial. If it runs out unlicensed, the workspace falls back to Community: nothing is deleted, and the plan's limits apply after a 14-day grace period. MSP › Customers shows your trials, with a notice when one ends within a week.

Yes. Each one is its own organization - separate data, separate access - not a shared tenant filtered by a customer ID. Managing ten customers means ten isolated organizations, and there is no query that spans them.

The workspace falls back to Community rather than being deleted. For 14 days everything keeps working and renewing; after that only as many certificates renew automatically as Community allows, oldest first, on Let's Encrypt with EC-256 keys. The rest stay installed and valid until they expire, configuration, agents and domains are untouched, and licensing the workspace again lifts the limit at once. The licence can then be assigned to someone else.

Your running trials and the five included Standard places end, so those workspaces fall back to Community under the same 14-day grace period - nothing is deleted. Customers on a slot you bought keep their tier: each slot runs until its own renewal date.

No. Every private key is generated on the server that will serve the certificate, by the agent, and never leaves that host. What comes back to us is metadata - serial number, fingerprint, validity window. This is true on every plan, including Community.

They keep working. Installed certificates are ordinary files and certificate-store entries on your own servers with no runtime dependency on us. What pauses is scheduling, so renewals resume when the control plane is reachable again - and the default 30-day renewal window is the margin that makes a short outage a non-event.

Storage and processing stay in Germany: the application runs on Hetzner in Nuremberg and the database on Supabase in Frankfurt (eu-central-1). Cloudflare sits in front as a TLS-terminating proxy for DDoS protection - it handles edge traffic, not data storage.

217, on every plan including Community. That covers Cloudflare, Route 53, Azure, Google Cloud, DigitalOcean, Hetzner and every other common provider, and includes ACME-DNS, a generic webhook and a custom script as escape hatches for anything not on the list.

Windows roles (certificate store, IIS, Exchange, ADFS, RDP/RDS, WinRM, SQL Server, Hyper-V Replica and more), web servers such as NGINX and Apache, load balancers and firewalls like Citrix NetScaler, F5 and FortiGate, hypervisors, Kubernetes, Docker and custom scripts on Linux or Windows. If your system is not listed, you can build a target for it yourself - the comparison table above has the details.

Your account profile and organization memberships, yes, as JSON from account settings. Self-service export of certificates and the full event log is not built yet - ask if you need it for a specific compliance requirement.

Not a tiered SLA today. aethercert is built and supported by one person, so support means a direct reply rather than a ticket queue with a response-time table. Security reports do have committed timelines - three business days to acknowledge, ten to assess.