Platform
A control plane + pull agents model, built in Go on PostgreSQL — deliberately boring infrastructure that your ops team already knows how to run.
Architecture
One server is the control plane: REST API, discovery engine with scheduler, CA gateway, and encrypted key vault, backed by a single PostgreSQL database. The web UI and CLI are equal-standing clients of the same API. Agents pull work from the server over mTLS — they accept no inbound connections and work behind NAT.
Deployment
Ready-to-go VM appliances
Prebuilt, customized appliance images for the three hypervisors your data center already runs — import, boot, and the console first-boot wizard handles networking, TLS and the admin account. Upgrades are a built-in one-command script.
Single binary
The server ships as one Go binary that also serves the web UI. No JVM, no application server, no external runtime dependencies.
One database
PostgreSQL is the only stateful dependency. Schema migrations are embedded and applied automatically on startup.
Containers or bare metal
Run it with docker compose in minutes, or as a plain systemd service. Your infrastructure, your rules.
On-premises by design
Your certificates and private keys never leave your network. There is no SaaS backend and no phone-home.
Security model
Secure by default
TLS and authentication are required out of the box; scanning of private ranges and insecure ACME endpoints is blocked unless explicitly enabled.
Envelope-encrypted keys
Every private key is encrypted with its own DEK under AES-256-GCM, wrapped by a master key — ready for KMS/HSM integration.
mTLS agent protocol
Agents authenticate with mutual TLS and only ever pull: no listening ports on your servers, no inbound firewall rules.
Server-side RBAC
Roles are enforced in the API, not in the UI — the CLI and any API client are subject to the same rules.
Complete audit trail
Every mutation and every login attempt is recorded and queryable.
Encrypted backups
Scheduled dumps with optional AES-256-GCM encryption to local, SFTP, SCP, or TFTP repositories — and a transactional restore.
Integrations
ens0key meets your environment where it is — certificate authorities, appliances, stores, identity, and your SIEM.
Certificate authorities
- ▸Built-in issuing CA (CRL + OCSP)
- ▸ACME (RFC 8555, HTTP-01)
- ▸Microsoft ADCS (Enterprise CA)
- ▸DigiCert CertCentral
- ▸EJBCA
Appliances & platforms
- ▸Cisco ISE (OpenAPI)
- ▸Cisco ESA (SSH)
- ▸Cisco WLC
- ▸Cisco IOS / network devices (agentless SSH)
- ▸F5 BIG-IP (iControl REST)
- ▸Microsoft IIS (HTTPS binding)
Certificate stores
- ▸PEM directories + reload hooks
- ▸PKCS#12 (.pfx)
- ▸JKS (Java keystores)
- ▸IIS bindings
Identity
- ▸OIDC (generic)
- ▸Microsoft Entra ID
- ▸LDAPS
- ▸Local accounts
Audit & SIEM
- ▸Syslog over UDP / TCP / TLS
- ▸RFC 5424 · CEF · JSON formats
- ▸One event stream for audit and SIEM
Notifications
- ▸Slack-compatible webhooks
- ▸E-mail (SMTP, STARTTLS/TLS)
- ▸Daily expiry digest
Don't see your platform?
New certificate-store and CA integrations are developed on request — per customer and per use case. And when a vendor's new version breaks an existing integration, we cover it with additional development: your automation keeps running.