Deploy targets

A deploy target tells the agent what to do with a certificate once it's issued. It's chosen per certificate, in Build > Certificate Jobs, grouped into Windows, Linux, and third-party.

Windows

Certificate store

Imports the certificate into the local machine certificate store. No binding is created - use this when another process on the box picks the certificate up by thumbprint.

IIS

Imports into the certificate store and creates or updates an IIS HTTPS binding, so a site starts serving the new certificate without a manual step in IIS Manager.

Exchange

Runs Import-ExchangeCertificate to assign the certificate to the services you choose (SMTP, IIS, POP, IMAP, UM). This assumes the agent runs on the Exchange server itself, with the Exchange Management Shell already installed - aethercert doesn't install Exchange tooling for you.

ADFS

Imports into the certificate store, then runs Set-AdfsSslCertificate or Set-AdfsCertificate (for token-signing/token-decrypting certificates) depending on which certificate usage you select. Assumes the agent runs on the ADFS server with the ADFS PowerShell module available.

All four Windows targets support an exportable private key option under Advanced Options, for the rare case where something else needs to re-export the key from the store later.

Linux

NGINX, Apache, and Custom all work the same way under the hood: the agent writes the certificate, chain, and private key to disk, then runs a reload command. The three presets only differ in their default file paths and reload command:

  • NGINX - defaults to systemctl reload nginx.
  • Apache - defaults to systemctl reload apache2.
  • Custom - no default reload command; set your own paths and command for anything else that reads certificates from disk.

Third-party: Citrix NetScaler

Uploads the certificate and key to a Citrix ADC / NetScaler appliance over its Nitro management API, and creates or updates the matching sslcertkey object. It does not bind the certificate to an SSL vserver - that's environment-specific enough that it's left as a manual step in NetScaler after deployment.