Agents & orchestration
Pull-model orchestrators over mTLS that put certificates where they belong, reload the services that use them, and prove the renewal actually worked. Linux and Windows.
No inbound connections. Ever.
An agent registers with a bootstrap token and receives an mTLS client certificate signed by a dedicated agent CA. New agents land pending until an admin approves them — only then can they claim work. From that point on they only pull: no listening ports on your servers, no inbound firewall rules, works behind NAT.
Register
Bootstrap token; the agent reports its capabilities and build id.
Approve
An admin gate before any job is claimed; the mTLS identity is issued.
Poll
The agent pulls jobs over mTLS, executes them, and reports results.
Supervisor + worker — verified binary upgrades
The supervisor handles the mTLS connection and runs a separate worker for each job. Upgrades verify and replace both binaries when needed, retain previous copies, and restart into the new supervisor after reporting the result.
ens0key-agent
supervisor- ▸Holds the mTLS connection: register, poll, report
- ▸Rotates the mTLS identity in place (reset / rekey)
- ▸Ships recent log lines into the UI on request
- ▸Verifies and upgrades both worker and supervisor binaries
ens0key-agent-worker
worker- ▸Executes each job as a short-lived subprocess
- ▸Store deploys with snapshot, post-deploy steps and verification
- ▸Discovery, ADCS enrollment, IIS binding on remote networks
- ▸Replaced on disk after checksum and self-test checks
Fleet upgrades from the platform
Queue upgrades from the Agents page. The supervisor checks and replaces the worker and its own binary, reports the result, then restarts when its binary changed.
Queue
The supervisor picks up the upgrade job on its next poll.
Verify
Download over mTLS, check SHA-256 and run each new binary’s self-test.
Replace
Atomically replace checked binaries, retaining previous copies for rollback.
Restart
Report the result and restart into the new supervisor when required. Older supervisors may need a one-time reinstall.
Zero-touch renewal with a safety net
Renewal is a sequence of recorded steps, including service verification and automatic rollback when verification fails.
Renew
The scheduler renews before expiry via the CA connector.
Deploy
The agent installs the certificate and key into the store, after taking a snapshot.
Reload
Ordered post-deploy steps reload the service that uses the certificate.
Verify
A service check confirms the new certificate is actually being served.
Rollback
Any failure restores the previous certificate automatically.
Service verification and automatic rollback are built into the renewal workflow.
Run a fleet, not one host
Blueprints
Template a full agent configuration — stores, renewals, checks — and roll it out across the fleet in one action.
Health & logs
Online/offline from a 60-second heartbeat; recent agent logs pulled straight into the UI.
Reset & rekey
The mTLS identity can be re-keyed in place, cancelling in-flight jobs safely.
Capability routing
Agents report what they can do at registration — the server routes each job only to agents that can run it.
Watch a renewal roll back, live
In a demo we deliberately break verification, and you watch the agent restore the previous certificate.
Request a demo