Terms of Service

1.Who we are, and what these terms cover

Aivendy Cert is a software service operated by Aivendy (“we”, “us”). It is offered to people who administer an Apache Tomcat server and want a TLS certificate on it.

These terms are the whole agreement between you and us for the service. Where a purchase is involved, the credits and prices shown at checkout at the time of the purchase are part of it.

2.What the fee buys, and what we do not sell

We do not issue or sell certificates. The certificates you obtain through the service are issued by Let’s Encrypt, a service of the Internet Security Research Group (ISRG), free of charge, under the Let’s Encrypt Subscriber Agreement. You accept that agreement directly with Let’s Encrypt, in the wizard, before any certificate is requested. We are not a party to it.

What we provide, and what any fee buys, is the work around the certificate: placing and tracking the issuance request; checking that validation will pass before anything is submitted; transforming your Tomcat configuration; packaging the result; install and rollback guidance; and expiry monitoring with reminders.

Aivendy Cert is not affiliated with or endorsed by ISRG / Let’s Encrypt, or the Apache Software Foundation. Let’s Encrypt is a trademark of ISRG; Apache Tomcat is a trademark of the Apache Software Foundation. Both names are used here descriptively, to say what the service works with.

3.Your account

You need an account with a verified email address to request a certificate. Keep your password to yourself. Until you tell us your account has been compromised, everything done with it counts as done by you.

One person, one account. The free issuance described below is one per account, for life, and creating further accounts to obtain more of them is a breach of these terms.

4.Hostnames you may request certificates for

You may request a certificate only for a hostname you control, or that you are authorised by its owner to administer. Passing the certificate authority’s validation is proof to the certificate authority. It is not permission from us, and it does not make a request permitted if you had no authority to make it.

You may not use the service for a hostname you do not control; to obtain a certificate for phishing, for distributing malware, or for impersonating someone else; to work around the per-account and per-address limits, or to pool free issuances across accounts; or in any way that spends Let’s Encrypt’s shared rate limits or reputation on requests you are not entitled to make. We refuse some hostnames outright, including names on public-suffix and dynamic-DNS lists, and we may add to that list without notice.

For every issuance request we record the account, the source address, the browser identification, the time, the hostname and the outcome, so that abuse can be traced and reported. We may refuse, suspend or close an account that breaches this section, and credits spent on the breaching requests are not returned.

5.Your private key and your configuration files never reach us

The certificate’s private key is generated in your browser and is never sent to us. Your server.xml and web.xml are read and transformed in your browser and are never sent to us either. We hold no credentials for your server or your DNS provider, and nothing in the service can connect to your server to change it.

Two consequences follow. We cannot recover a private key you have lost: if the downloaded bundle is gone, the certificate has to be issued again. And what we can see of your certificate is its public half: we keep the fingerprint of the public key and the certificate’s hostnames and dates, so that we can remind you before it expires and refuse a key that does not match.

6.The generated files, and what you are responsible for

Every action on your server is performed by you, following our guidance. We generate configuration files; you review, install, test and restart. The generated files are provided as they are. You are responsible for reviewing the on-screen diff, for keeping the backup we include, for testing on a non-production server first, and for following the rollback steps if the server does not start.

A configuration that is wrong for your server can stop Tomcat from starting. That is why every bundle ships with the unchanged original, the diff, a pre-start check and a rollback. Use them.

7.One certificate per Tomcat instance, for now

The service currently configures one certificate on one Tomcat instance. It refuses to install a certificate for a second hostname on an instance it has already set up. It also refuses, or asks you to confirm first, when your existing configuration already serves other hostnames, authenticates clients by certificate, or carries a certificate we cannot identify. A second hostname needs a second Tomcat instance, or a manual install. We say this here so that it is not a surprise after you have paid.

8.Free issuance, credits and prices

Everything that never contacts the certificate authority is free and unlimited: hostname checks, the pre-flight probe, the server profile wizard, uploading and transforming your configuration, and the diff. Every account also gets exactly one free certificate issuance, for life.

After that, each issuance, renewals included, spends one credit. Credits are bought in the amounts and at the prices shown on the pricing page and at checkout, through PayPal; we never see your card or account details. Credits do not expire and are not tied to a hostname until spent. A credit is spent when a certificate is issued, not when a request is started.

Prices are shown in US dollars and may change. A change applies to purchases made after it, never to credits you already hold.

9.Refunds

If an issuance fails for a reason on our side, including a rate limit or an error from the certificate authority, the credit is returned to your account automatically. An issuance you start and do not finish is returned to your account automatically after seven days.

If validation fails because your hostname could not be reached, because the DNS record or the challenge file was not in place, the credit is not returned automatically: the request reached the certificate authority and spent a real attempt against limits shared by everyone. Write to us, and we will look at it.

For anything else, including a refund of the money paid for credits you have not spent, write to us at support@aivendy.com. We answer every such request. Where these terms do not promise a refund, giving one is our decision.

10.Expiry monitoring and renewal

We watch the expiry date of every certificate issued through the service and email you 30, 14 and 5 days before it, and again once it has expired. Let’s Encrypt no longer sends expiry reminders of its own.

Renewal is not something the service can do for you without you: we do not hold your private key, and every renewal needs you to prove control of the hostname again. Renewal is one click in the wizard when you choose to do it. A reminder can be delayed or lost, by a full mailbox or a spam filter, and you remain responsible for renewing before the certificate expires. Certificate lifetimes are set by the certificate authority and are getting shorter.

11.Availability, limits and changes

The service depends on Let’s Encrypt, whose rate limits are shared between all of our users. We may pause or slow issuance to stay within them, and a request refused for that reason spends no credit. We do not promise that the service will be available at any particular time, and we may change, add or remove features. If we withdraw the service altogether, credits you have not spent are refunded.

12.No warranty

The service and every file it produces are provided as they are and as available. We do not promise that a certificate will be issued, that a generated configuration will work on your server, or that the service will be free of errors. Nothing in this section removes a right the law gives you that cannot be given up.

13.Limits on our liability

To the extent the law allows, we are not liable for indirect or consequential loss, including downtime, lost business or loss of data, arising from your use of the service or of the files it produces. Our total liability to you for anything arising from the service is limited to the amount you paid us in the twelve months before the claim.

14.Ending the relationship

You can stop using the service at any time and ask us to delete your account. We can suspend or close an account that breaches these terms, and we will say why unless the law prevents it. Closing an account does not affect a certificate already issued: it is yours, and it stays valid until it expires. Credits you have not spent are refunded when we close an account for a reason other than a breach of these terms.

15.What we store about you

We store your email address, your language preference, your server profiles, the record of each issuance request described above, the public details of each certificate, and the payment records PayPal sends us. We do not store your card or bank details; PayPal holds those. Reminder and account emails are sent from notify.aivendy.com and auth.aivendy.com.

16.Changes to these terms

We may change these terms. The version and date at the top of this page identify the current version. For a change that reduces what you get or adds an obligation, we email account holders before it takes effect, and continuing to use the service after that date is acceptance of the new terms.

17.Contact

Write to us at support@aivendy.com. That address is the way to raise a refund, a security concern or a complaint.