Certificate agent

The certificate is issued in DNS-Editor — but it has to reach the machine that uses it. The certificate agent (dnseditor-cert-agent) is a small program on the target system: it fetches its assigned certificates, deploys them in the configured format, reloads the affected service and repeats all of that on every renewal, unattended.

In the cloud the agent belongs to the Pro and Enterprise models; on Free and Plus creating tokens is blocked (existing tokens stay visible and revocable after a downgrade).

Three-step setup

Create a token: on the project’s certificate page → New agent token. You pick which certificates the agent may fetch — the token can do nothing else. It is shown exactly once, as a ready-to-copy setup command.
Install the agent (.deb/.rpm, Docker sidecar or as a Windows service) and run the copied command:
Terminal window
```
dnseditor-cert-agent setup --host https://dnseditor.de --token dnseagent_…
```
Set the deploy paths and the reload command in /etc/dnseditor-cert-agent/config.yaml, test with sync, start the service.

Formats: pem (nginx/Apache), pem-combined (HAProxy), pkcs12 (Windows/Java, with password), der — multiple deployments per certificate are fine.

Visibility

The certificate page shows, per token, the last contact (time, IP, agent version) and, per certificate, whether the deployed stand is up to date or stale — after a renewal you see immediately which systems already carry the new certificate. Tokens are revocable at any time; the agent loses access instantly.

Security

The agent runs as its own unprivileged user. Reload commands go through a narrow sudoers rule (sudo -n) allowing exactly the configured commands. The token never expires (unattended operation), is stored hashed and can only fetch its bound certificates — DNS changes are impossible with it.

Full guide (packages, Docker patterns, private PKI): certificate-agent repository.