Platform
A control plane + pull agents model, built in Go on PostgreSQL: deliberately boring infrastructure that your ops team already knows how to run.
Architecture
One server is the control plane: REST API, discovery engine with scheduler, CA gateway, and encrypted key vault, backed by a single PostgreSQL database. The web UI and CLI are equal-standing clients of the same API. Agents pull work from the server over mTLS; they accept no inbound connections and work behind NAT.
Deployment
Ready-to-go VM appliances
Prebuilt, customized appliance images for the three hypervisors your data center already runs: import, boot, and the console first-boot wizard handles networking, TLS and the admin account. Upgrades are a built-in one-command script.
Single binary
The server ships as one Go binary that also serves the web UI. No JVM, no application server, no external runtime dependencies.
One database
PostgreSQL is the only stateful dependency. Schema migrations are embedded and applied automatically on startup.
Containers or bare metal
Run it with docker compose in minutes, or as a plain systemd service. Your infrastructure, your rules.
On-premises by design
ens0key runs on your infrastructure, without a hosted ens0key control plane. Connections to external CAs and cloud certificate stores are configured by you.
HA-ready
Run several app replicas behind a load balancer: a Postgres advisory lock keeps one scheduler leader, and a warm-standby runbook covers database failover.
Security model
Secure by default
TLS and authentication are required out of the box; scanning of private ranges and insecure ACME endpoints is blocked unless explicitly enabled.
Envelope-encrypted keys
Private keys are protected with AES-256-GCM envelope encryption. The provider, compatibility and scope of any KMS/HSM integration are confirmed in the proposal.
mTLS agent protocol
Agents authenticate with mutual TLS and only ever pull: no listening ports on your servers, no inbound firewall rules.
Server-side RBAC
Roles are enforced in the API, not in the UI — the CLI and any API client are subject to the same rules.
Complete audit trail
Every mutation and every login attempt is recorded and queryable.
Encrypted backups
Scheduled dumps with optional AES-256-GCM encryption to local, SFTP, SCP, or TFTP repositories — and a transactional restore.
Local account MFA
TOTP with single-use recovery codes or Cisco Duo Universal Prompt. Require MFA for local administrators or all local users; SSO and LDAP retain their own policies.
Integrations
ens0key meets your environment where it is: certificate authorities, appliances, stores, identity, and your SIEM.
Certificate authorities
- ▸Built-in issuing CA (CRL + OCSP)
- ▸ACME (RFC 8555, HTTP-01)
- ▸Microsoft ADCS (Enterprise CA)
- ▸DigiCert CertCentral
- ▸EJBCA
Device & MDM enrollment
- ▸EST (RFC 7030, mTLS)
- ▸SCEP (RFC 8894, RSA RA + challenge)
Appliances & platforms
- ▸Cisco ISE (OpenAPI)
- ▸Cisco ESA (SSH)
- ▸Cisco WLC
- ▸Cisco IOS / network devices (agentless SSH)
- ▸F5 BIG-IP (iControl REST)
- ▸Fortinet FortiGate
- ▸Citrix NetScaler
- ▸Microsoft IIS (HTTPS binding)
Cloud certificate stores
- ▸Azure Key Vault
- ▸AWS ACM
- ▸GCP Certificate Manager
Certificate stores
- ▸PEM directories + reload hooks
- ▸PKCS#12 (.pfx)
- ▸JKS (Java keystores)
- ▸IIS bindings
Identity
- ▸OIDC (generic)
- ▸Microsoft Entra ID
- ▸LDAPS
- ▸Local accounts
- ▸TOTP · Google Authenticator
- ▸Cisco Duo Universal Prompt
Audit, SIEM & monitoring
- ▸Syslog over UDP / TCP / TLS
- ▸RFC 5424 · CEF · JSON formats
- ▸One event stream for audit and SIEM
- ▸Prometheus /metrics endpoint
Notifications
- ▸Slack-compatible webhooks
- ▸E-mail (SMTP, STARTTLS/TLS)
- ▸Daily expiry digest
Check compatibility for your environment
Use this overview to plan a pilot. Exact vendor versions, permissions and supported operations are confirmed for the selected connector in your proposal.
| Integration | Purpose | Confirm in the pilot |
|---|---|---|
| CA connectors | Issuance and renewal; unsupported external revocation uses the issuer portal | CA version, enrollment permissions and required issuance/revocation flows |
| Agent stores: PEM, PKCS#12, JKS, IIS | Certificate deployment and renewal on Linux and Windows | Store configuration, service reload, TLS verification and rollback scenario |
| Network appliances and cloud stores | Agentless certificate deployment to the selected target | Vendor/API version, target binding and renewal verification; ESA management HTTPS binding is not ready |
| KMS / HSM | Integration with the encrypted key vault | Provider, key-management model and integration scope in the proposal |
| Local MFA / Cisco Duo | Second-factor authentication for local application accounts | Duo Web SDK configuration, account mappings, enforcement policy and recovery access |
| API credential inventory | Ownership, deadlines, metadata history and alerts | Metadata intake and notification routing; no automatic provider rotation or discovery |
Don't see your platform?
New certificate-store and CA integrations are developed on request, per customer and per use case. And when a vendor's new version breaks an existing integration, we cover it with additional development: your automation keeps running.