Certificates that look after themselves

The same automation, whichever way you come at it: whether you run a handful of servers or several hundred for other people, and whether the certificate comes from a public authority or from your own.

Businesses

You run your own servers

A website, a mail server, some internal applications, and not much time for any of it. aethercert renews the certificates and installs them where the service will actually pick them up - on Windows and on Linux.

For small and mid-sized companies

IT service providers

You run them for other people

Multi-tenant, with a fully separate workspace per customer and one login across all of them. You buy customer licences at a wholesale rate and charge what the service is worth - we never invoice your customer.

Certificate management for MSPs

Certificate authorities

Public, private, or both at once

Internal and publicly trusted certificates share one dashboard, one renewal schedule and one audit trail - there is no second system for the internal ones.

Public certificate authorities

Publicly trusted certificates

Let's Encrypt is set up on every account and needs no configuration. Google Trust Services, ZeroSSL, SSL.com and Actalis connect with an account key pair, and any other ACME authority works the same way. Validation, wildcards, installation and renewal are all handled.

Public CAs & ACME

Internal & private CA

Certificates from your own CA

A self-hosted ACME server, a REST signing endpoint, or Active Directory Certificate Services through a connector installed on the CA host. Signing requests never leave your network, and internal names never touch public DNS.

Internal & private CA

In every case

The same machinery underneath

A certificate is not finished when it is issued. Everything below applies whichever authority signed it and whoever is operating the account.

Installed where it is served

IIS bindings, Exchange, ADFS, Remote Desktop, WinRM, SQL Server and Hyper-V Replica on Windows; NGINX, Apache or any file path with a reload command on Linux; Citrix NetScaler and Docker containers from either.

Renewal without a person

Queued a configurable number of days before expiry - 30 by default - reissued with a fresh key on the host, reinstalled, and retried automatically if an attempt fails.

Certificates you did not issue

Each agent inventories the certificates already installed on its own server and reports them, so their expiry dates are visible next to the ones aethercert manages.

DNS-01 or HTTP-01

217 DNS providers on every plan, including Free. DNS validation is what makes wildcards and internal-only hostnames possible; credentials are stored encrypted and handed out only while a challenge is being solved.

One rule for a fleet

Group the servers that do the same work and attach a certificate policy. Every member gets its certificate, including machines enrolled long after the rule was written.

Roles, access and an audit trail

Viewer, member, admin and owner enforced in the database rather than only in the interface, mandatory multi-factor authentication, and an append-only log of every issuance, renewal and installation attempt.

See how each piece works

The documentation covers every concept and every setting in depth.

How it works Certificate authorities Deploy targets Security & data handling Dashboard reference

Start with one certificate

Free covers one certificate on one server with Let's Encrypt, with no payment details, so you can see the whole cycle run before deciding anything.

Get started free View pricing

Free plan, no card required. aethercert is invite-only while it scales - leave your email and you'll hear back from us directly.