The free certificate utility for Windows
aethercert Toolkit creates CSRs, imports and exports certificates in the Windows certificate store, converts PFX files, signs code and scans your own network for TLS certificates. It needs no account, installs from a signed MSI, and certificates and keys stay on your computer.
- Free, Apache-2.0 licence
- No account required
- Offline installer for servers
- English and German
Version 1.1.2 · 27 October 2026 · Windows x64 · free · Download the aethercert Toolkit
Seven certificate tools in one window
The app opens on your certificate list. Every tool is also available as an actk command.
Your private keys stay on this computer
The Toolkit keeps the same rule as the aethercert platform: key material is created locally and never leaves the machine.
Keys in the Windows key store
Create CSR generates the key in the Microsoft Software Key Storage Provider of this user or this computer, the way certreq does. Windows signs the request; the key is never in a file or in the app, and it is not exportable unless you choose otherwise.
Or a key file, where a server needs one
For nginx, Apache or HAProxy the key can be written to a PEM file instead, optionally encrypted with a password (PKCS#8, AES-256). A .key written by an export is encrypted by default.
Imports find their key
When the CA returns the certificate, Import matches it to its key by the SHA-256 of the public key. Only the location of a key file is remembered, never the key itself.
Nothing is uploaded
The Toolkit sends no usage data and needs no aethercert account. Scans connect only to the hosts you enter, and no report, export or log contains private key material.
Download the aethercert Toolkit
Two installers and the command line, each Authenticode-signed and listed with its SHA-256 checksum. Both installers set up the same app; they differ only in how the Microsoft Edge WebView2 runtime, which draws the window, gets onto the machine.
- .msi
Installer (MSI)
The recommended download. If Windows does not have the WebView2 runtime yet, setup downloads it from Microsoft.
aethercert-toolkit-windows-amd64-en-US.msi
- .msi
Offline installer (MSI)
For servers without internet access: carries the WebView2 runtime, so setup needs no connection. About 210 MB.
aethercert-toolkit-windows-amd64-offline-en-US.msi
- .exe
Command line
actk as a single executable - the same tools for scripts, scheduled scans and Server Core, with nothing to install.
actk-windows-amd64.exe
Version 1.1.2 · 27 October 2026 · Windows x64 · free · SHA-256 checksums
Requirements
- Windows 11 or Windows Server 2019, 2022 or 2025, 64-bit
- Administrator rights to install - the app itself runs as a normal user
- Silent installation for software distribution: msiexec /i <file> /qn
Check the download
Compare the hash with the published SHA256SUMS and check the signature in PowerShell:
Get-FileHash .\aethercert-toolkit-windows-amd64-en-US.msi -Algorithm SHA256Get-AuthenticodeSignature .\aethercert-toolkit-windows-amd64-en-US.msi | Format-ListThe same tools on the command line
actk runs every tool without a window - for scripts, scheduled certificate inventories and Server Core.
actk csr --cn www.example.com --san example.com --ip 10.0.0.15 --org "Example GmbH" --country DE --key rsa2048 --encrypt-keyactk store import issued.p7b --key www_example_com.keyactk pfx --cert issued.pem --chain intermediate.pem --key www_example_com.key --out www.pfxactk sign Setup.exe deploy.ps1 --thumbprint 0123ABCD...actk scan 10.0.0.0/24 srv01.corp.local -p 443,636,3389,8443 --csv inventory.csvactk security intranet.corp.local:8443 --json report.jsonCompared with the tools you already have
Windows ships certreq and the certificate console, and OpenSSL covers most tasks through command-line options. The Toolkit offers a form for each task and works with certificates from any CA.
| Task | Windows built-in | OpenSSL | aethercert Toolkit |
|---|---|---|---|
| Create a CSR with SANs | certreq with an INF file, or the custom request wizard in the certificate console | openssl req with a config file or -addext | One form; names and IP addresses checked as you type |
| Install the issued certificate with its key | certreq -accept on the computer that created the request | Keep track of the .key file yourself | Import finds the matching key by itself |
| Build a PFX | Export wizard, from the store only | openssl pkcs12 -export | Checks the key matches first; 3DES for Windows Server 2016 and older |
| Sign code | signtool from the Windows SDK | Not covered (osslsigncode is a separate tool) | Sign code page or actk sign, with timestamp |
| Find certificates on the network | Not built in | openssl s_client, one host and port at a time | Networks, ranges and ports concurrently, exported as CSV or JSON |
| Grade a TLS configuration | Not built in | Not built in | A+ to F with the aethercert Security Scan rubric |
Frequently asked questions
aethercert Toolkit
Does the aethercert Toolkit cost anything?
No. It is published under the Apache-2.0 licence and may be used privately and commercially.
Does the Toolkit send anything to aethercert?
No. It only connects to the hosts you scan and, when you sign code, to the timestamp server you choose.
Which Windows versions does it run on?
Windows 11 and Windows Server 2019, 2022 and 2025, 64-bit. Setup installs the Microsoft Edge WebView2 runtime if it is missing - the offline installer without an internet connection.
Do I need administrator rights?
Once, to install it. After that, CSRs, the current user's certificates, code signing and scans work as a normal user. To change the computer certificate store, restart the app as administrator from within the app.
Does the Toolkit renew certificates automatically?
No. Automatic renewal and installation on servers is what the aethercert platform does, free for up to two servers.
Renewing the same certificates every few months?
aethercert renews certificates and installs them on your servers automatically, free for up to two servers.
Community plan, no card required. Open registration - your account is ready in a few minutes.