Agents

The agent is a small binary that runs on the server that needs a certificate. It polls aethercert on an interval the control plane controls - it never needs an inbound connection, so it works fine behind NAT or a restrictive firewall.

Enrolling a new agent

Create an enrollment token under Build > Agents. Tokens are single-use and expire, so a leaked token can't be reused later. The agent only shows up under View > Agents once it actually connects - creating a token doesn't create an agent by itself.

Installing

Run the install command as an administrator/root. It downloads nothing further - it enrolls, registers itself as a service, and starts immediately:

# Linux (as root)
chmod +x aethercert-agent-linux-amd64
sudo ./aethercert-agent-linux-amd64 install --api <your-api-url> --token <token>

# Windows (PowerShell, as Administrator)
.\aethercert-agent-windows-amd64.exe install --api <your-api-url> --token <token>

On Linux this registers a systemd service; on Windows, a Windows Service Control Manager service. Either way it restarts automatically if the process exits or the machine reboots.

Self-updates

Every check-in tells the agent whether a newer version is available. If the agent is running as an installed service, it downloads and applies the update, then exits so the service manager restarts it into the new binary. If you're running it interactively in a terminal (not as a service), it skips self-updates - there's nothing to restart it, so update manually instead.

Uninstalling

aethercert-agent uninstall

Run this elevated as well - it stops and removes the service.

Grouping agents

Servers doing the same job - replicas behind a load balancer, for example - can be put in an agent group so one certificate targets all of them at once. See Agent groups.