Platform

A control plane + pull agents model, built in Go on PostgreSQL — deliberately boring infrastructure that your ops team already knows how to run.

Architecture

One server is the control plane: REST API, discovery engine with scheduler, CA gateway, and encrypted key vault, backed by a single PostgreSQL database. The web UI and CLI are equal-standing clients of the same API. Agents pull work from the server over mTLS — they accept no inbound connections and work behind NAT.

Web UI · CLI · Your automation
ens0key-server
REST API
Discovery engine + scheduler
CA gateway
Key vault (AES-256-GCM)
PostgreSQL
ACME · DigiCert · EJBCA
ens0key-agent (pull, mTLS)
PEM · PKCS#12 · JKS stores

Deployment

Ready-to-go VM appliances

VMware / ESXi · OVAMicrosoft Hyper-V · VHDXProxmox / KVM · qcow2

Prebuilt, customized appliance images for the three hypervisors your data center already runs — import, boot, and the console first-boot wizard handles networking, TLS and the admin account. Upgrades are a built-in one-command script.

Single binary

The server ships as one Go binary that also serves the web UI. No JVM, no application server, no external runtime dependencies.

One database

PostgreSQL is the only stateful dependency. Schema migrations are embedded and applied automatically on startup.

Containers or bare metal

Run it with docker compose in minutes, or as a plain systemd service. Your infrastructure, your rules.

On-premises by design

Your certificates and private keys never leave your network. There is no SaaS backend and no phone-home.

Security model

Secure by default

TLS and authentication are required out of the box; scanning of private ranges and insecure ACME endpoints is blocked unless explicitly enabled.

Envelope-encrypted keys

Every private key is encrypted with its own DEK under AES-256-GCM, wrapped by a master key — ready for KMS/HSM integration.

mTLS agent protocol

Agents authenticate with mutual TLS and only ever pull: no listening ports on your servers, no inbound firewall rules.

Server-side RBAC

Roles are enforced in the API, not in the UI — the CLI and any API client are subject to the same rules.

Complete audit trail

Every mutation and every login attempt is recorded and queryable.

Encrypted backups

Scheduled dumps with optional AES-256-GCM encryption to local, SFTP, SCP, or TFTP repositories — and a transactional restore.

Integrations

ens0key meets your environment where it is — certificate authorities, appliances, stores, identity, and your SIEM.

Certificate authorities

  • Built-in issuing CA (CRL + OCSP)
  • ACME (RFC 8555, HTTP-01)
  • Microsoft ADCS (Enterprise CA)
  • DigiCert CertCentral
  • EJBCA

Appliances & platforms

  • Cisco ISE (OpenAPI)
  • Cisco ESA (SSH)
  • Cisco WLC
  • Cisco IOS / network devices (agentless SSH)
  • F5 BIG-IP (iControl REST)
  • Microsoft IIS (HTTPS binding)

Certificate stores

  • PEM directories + reload hooks
  • PKCS#12 (.pfx)
  • JKS (Java keystores)
  • IIS bindings

Identity

  • OIDC (generic)
  • Microsoft Entra ID
  • LDAPS
  • Local accounts

Audit & SIEM

  • Syslog over UDP / TCP / TLS
  • RFC 5424 · CEF · JSON formats
  • One event stream for audit and SIEM

Notifications

  • Slack-compatible webhooks
  • E-mail (SMTP, STARTTLS/TLS)
  • Daily expiry digest

Don't see your platform?

New certificate-store and CA integrations are developed on request — per customer and per use case. And when a vendor's new version breaks an existing integration, we cover it with additional development: your automation keeps running.

Architecture questions?

We're engineers. Bring your topology and your edge cases.

Talk to an engineer