Features
Everything in ens0key is available through the REST API: the web UI and CLI are equal-standing clients on top of it.
Certificate lifecycle (CLM)
From first discovery to retirement: a complete, deduplicated picture of your certificate estate.
Discovery
TLS scanning of targets and CIDR ranges (up to 4096 addresses), ad-hoc and on a schedule — plus agent-side discovery for networks the server cannot reach.
Inventory
Deduplicated inventory with a wider certificate panel: identity, SANs, key, signature and service evidence first; expandable history and technical details.
Import
PEM and PKCS#12 (.pfx) via UI, API, or CLI — purchased certificates ready for on-prem distribution.
Metadata & collections
Centrally defined, searchable fields (owner, application…) and collections as saved queries over the inventory.
Flags
Automatic flagging: expired, expiring soon, self-signed, weak key, SHA-1 signature.
Alerts & notifications
Slack-compatible webhooks plus an e-mail channel: daily expiry digest and lifecycle event mails (SMTP, STARTTLS/TLS).
Dashboard
Expiry heatmap, CA breakdown, and key-strength report — inventory health at a glance.
Lifecycle timeline
Each certificate's detail view tells its story in order: issued, discovered, deployed, renewed (with a link to the successor), revoked, expires.
ens0key 1.0.34 · Example data
PKI automation
Operate an internal CA and coordinate external issuance and renewal. Available revocation operations depend on the connector.
CA connectors
Internal CA with CRL and OCSP; issuance and renewal through ACME, DigiCert, EJBCA and Microsoft AD CS. Unsupported external revocation must be completed in the issuer portal.
Key vault
Private keys are protected with AES-256-GCM envelope encryption. The provider, compatibility and scope of any KMS/HSM integration are confirmed in the proposal.
Agents
Pull-model orchestrators with mTLS: PEM/PKCS#12/JKS/IIS stores, auto-renewal with reload hooks, service verification, and blueprints for mass rollout — no inbound connections, works behind NAT.
Agentless deploy
Deploy from the server to F5, Cisco ISE/ESA/WLC, FortiGate, NetScaler, cloud stores and Kubernetes TLS Secrets. Catalyst 9800 uses verified HTTPS and pinned SSH, selected-service checks and durable recovery.
SCEP / EST
Built-in enrollment servers for devices and MDM: EST (RFC 7030) over mTLS, and SCEP (RFC 8894) with an RSA RA and challenge, issuing from an internal CA.
Locations
Pending, running, successful and failed outcomes across agent stores and agentless targets. A failed retry preserves the last successful installation; older records may need verification.
Approvals
A single inbox for everything that needs a decision: pending enrollment requests and waiting workflow instances, each with Approve/Deny.
Certificate issuance
Choose ECDSA P-256 or RSA-2048/3072/4096, enter separate DNS/IP SANs and select or type an ADCS template. Renewal preserves key algorithm and size.
ens0key 1.0.34 · Example data
Platform & security
The controls your security team expects come built into the product.
SSO
OIDC sign-in (generic + Microsoft Entra ID preset) next to LDAPS and the local admin.
RBAC
Viewer, operator, and admin roles mapped from LDAP/SSO groups or users, enforced server-side.
Audit log
Every mutation and login attempt recorded.
Backup & restore
Named repositories (local/SFTP/SCP/TFTP), scheduled or manual dumps, optional AES-256-GCM encryption, transactional in-app restore.
Web UI
English, Croatian and German; dark and light themes, responsive inventory and user cards, accessible dialogs, persistent page URLs and searchable in-app help.
Local account MFA
TOTP with single-use recovery codes or Cisco Duo Universal Prompt. Require MFA for local administrators or all local users; SSO and LDAP retain their own policies.
System settings
Grouped access, monitoring and maintenance. SMTP delivery is saved independently from notification recipients and rules, preserving unrelated settings.
ens0key 1.0.34 · Example data
API credential inventory
Keep ownership and action deadlines visible alongside your certificate estate. This module stores metadata and vault references; actual secret values remain in your existing vault.
Ownership & context
API tokens, PATs, keys and client secrets with application, environment, principal, issuing identity, owner, team and consumers.
Deadlines & findings
Expiry, rotation and review deadlines; findings for missing ownership, unknown expiry and stale reviews, with owner/fallback notifications.
Operator workflow
CSV import/export, priority sorting, acknowledgement, replacement runbooks and an auditable metadata history.
Scope of this release
Manual, CSV or API metadata intake. Automatic provider discovery, validity checks, issuance, rotation and revocation are outside this release.