Build a certificate service you can sell

Yes - that is what the MSP plan is built for. You buy customer licences at a discounted rate, assign them to the customer workspaces you create, and charge your customers whatever you decide. aethercert has no commercial relationship with them: you invoice them, you set the price, and you own the contract.

Yes, and in the strict sense. Each customer is a separate organization with its own domains, servers, certificates, authorities, members and audit log - not one shared tenant filtered by a customer ID. There is no query that spans two customers, so there is nothing for one of them to see about another. You switch between them from a single login.

You do, and the product is built to say so: a customer workspace's own support screen shows your company name and your contact details rather than ours. As an MSP you are a direct aethercert customer, so your own support comes from us directly.

Not today. The dashboard your customers see - if you give them a login at all - carries aethercert's branding. What is yours is the commercial relationship, the pricing and the support contact shown in their workspace. Many providers run it without giving the customer a login at all, which makes the question moot; if white-labelling would decide it for you, tell us, because that is what moves it up the list.

However you want. You hold the licence, so what you charge is independent of what you pay - per server, per certificate, folded into an existing managed-service package, or as a flat line item. aethercert never sees your pricing and never contacts your customer about it.

There is no cap on customer workspaces. Five Standard-tier places are included with the MSP plan, and you buy additional Standard or Pro places from the dashboard as you sign customers. Each is its own annual subscription with its own renewal date, so capacity follows your book rather than a contract negotiation.

Creating the workspace is a form. After that the work is installing the agent on the customer's servers, which is one elevated command per server, and a multi-provision token lets the same command run on every one of them. Their existing certificates show up with expiry dates as soon as the agents check in, which usually makes the first review the thing you can bill for.

Yes, through a management invitation. You send a single-use link, an owner of that organization accepts it and chooses how much the arrangement covers - everything operational, or full control. Neither side can create the relationship alone, and either side can end it later without the other's agreement. Their existing subscription stays theirs and does not consume one of your places.

Yes. By default everyone in your organization works in every customer workspace, but each person can instead be assigned specific customers, at a role chosen per customer - admin at one, viewer at another, regardless of their role in your own organization.

Only if you want them to. Some providers operate the workspace entirely and the customer never signs in. Others invite the customer as a viewer so they can see their own certificate status without changing anything, or as an admin if they should configure things themselves. Both models are supported by the same role system.

Release their licence and reassign it to someone else. The workspace is not deleted - it drops to Free-plan limits, the certificates already installed on their servers keep working, and their data is still there if they come back. Detaching the workspace ends the relationship itself and hands the workspace back to them.

Less than you would expect. Let's Encrypt is set up on every workspace and needs no configuration, and the deploy targets are presets - IIS, Exchange, Remote Desktop, NGINX, Apache, a load balancer - rather than something to script per customer. The part that needs your expertise is knowing which of a customer's systems serve TLS at all, which is knowledge you already have about them.

Windows Server and Linux. On Windows it installs into the certificate store and, depending on the target, updates the IIS binding, the Exchange services, ADFS, the Remote Desktop or RDS deployment configuration, the WinRM HTTPS listener, SQL Server, Skype for Business or Hyper-V Replica. On Linux it writes the files and reloads NGINX, Apache or anything else that reads a certificate from disk. It also pushes to Citrix NetScaler over its management API and into running Docker containers.

No, which is usually the question that decides whether a customer will agree to it. The agent makes outbound HTTPS connections and accepts none - no inbound firewall rule, no VPN, no public IP address, nothing listening. It works unchanged behind NAT.

On their own servers. Each key is generated by the agent on the machine that will serve the certificate, at every issuance and every renewal, and is never transmitted. aethercert stores metadata only - serial number, fingerprint, validity. Neither you nor we hold a customer's key material, which is a considerably easier conversation than an escrow model.

Yes, and it is often the fastest way to prove the service's value. Each agent inventories the certificates already installed on the server it runs on - whoever put them there, whenever - and reports them with their expiry dates. It reads only that machine and never opens a private key. It cannot renew a certificate it did not issue, but taking one over means creating a certificate for the same names.

Into monitoring, yes. Every workspace on Pro exposes fleet metrics in Prometheus format for CheckMK, Grafana or anything that scrapes it, and pushes alert-worthy events to a webhook, a SIEM over syslog/CEF, or an SNMP trap receiver. There is no public API for provisioning yet, so creating workspaces and certificates is done in the dashboard.

Germany - the application on Hetzner in Nuremberg, the database on Supabase in Frankfurt, with Cloudflare in front as a TLS-terminating proxy that handles traffic rather than storage. For customers who ask where their data goes, storage and processing stay in the country. Their keys and certificates never leave their own machines regardless.