Features
Everything in ens0key is available through the REST API — the web UI and CLI are equal-standing clients on top of it.
Certificate lifecycle (CLM)
From first discovery to retirement — a complete, deduplicated picture of your certificate estate.
Discovery
TLS scanning of targets and CIDR ranges (up to 4096 addresses), ad-hoc and on a schedule — plus agent-side discovery for networks the server cannot reach.
Inventory
Deduplication by SHA-256 fingerprint, observation history of where and when a certificate was seen, and source tracking for every entry.
Import
PEM and PKCS#12 (.pfx) via UI, API, or CLI — purchased certificates ready for on-prem distribution.
Metadata & collections
Centrally defined, searchable fields (owner, application…) and collections as saved queries over the inventory.
Flags
Automatic flagging: expired, expiring soon, self-signed, weak key, SHA-1 signature.
Alerts & notifications
Slack-compatible webhooks plus an e-mail channel: daily expiry digest and lifecycle event mails (SMTP, STARTTLS/TLS).
Dashboard
Expiry heatmap, CA breakdown, and key-strength report — inventory health at a glance.
PKI automation
Run your own CA or drive external ones — issuance, renewal, and revocation through one gateway.
CA connectors
Internal issuing CA with a real CRL and OCSP responder; ACME (RFC 8555, HTTP-01); DigiCert CertCentral; EJBCA — issuance, renewal, revocation.
Key vault
Private keys encrypted with an envelope scheme (AES-256-GCM, per-key DEK), ready for KMS/HSM integration.
Agents
Pull-model orchestrators with mTLS: PEM/PKCS#12/JKS stores, auto-renewal with reload hooks, service verification, and blueprints for mass rollout — no inbound connections, works behind NAT.
Approvals
Optional workflow: enrollment goes to a request queue and is issued only after approval.
Platform & security
The controls your security team expects, built in — not bolted on.
SSO
OIDC sign-in (generic + Microsoft Entra ID preset) next to LDAPS and the local admin.
RBAC
Viewer, operator, and admin roles mapped from LDAP/SSO groups or users, enforced server-side.
Audit log
Every mutation and login attempt recorded.
Backup & restore
Named repositories (local/SFTP/SCP/TFTP), scheduled or manual dumps, optional AES-256-GCM encryption, transactional in-app restore.
Web UI
React SPA served from the same binary; dark and light themes, HR/EN, searchable in-app help.
