Why ens0key
Compare deployment approaches and use a guided pilot to verify how ens0key fits your certificate estate.
Why now: certificate lifetimes are collapsing
Publicly trusted TLS certificates are moving from a maximum of 398 days to 47 days by 2029 under CA/Browser Forum ballot SC-081v3. That implies roughly 8.5 times as many renewals compared with the former 398-day maximum. Automated renewal and verification help teams manage this shorter cycle.
Maximum validity of publicly trusted TLS certificates. OV/EV shorten on the same schedule.
Three ways the market solves this
Enterprise suites
A broad set of lifecycle and governance capabilities. Evaluate deployment requirements, integration coverage and operational effort against your needs.
CA-bundled managers
A natural starting point when working with a particular CA. Check support for other issuers, private PKI and your deployment model.
DIY & open source
Flexible building blocks for renewal and deployment. Check how inventory, access control, auditing and maintenance fit together in your chosen stack.
The gap: full lifecycle governance, CA-agnostic, on-prem and air-gap friendly, at a footprint and price a mid-size team can actually run. That is exactly where ens0key sits.
What to verify in your evaluation
Use the pilot to check the workflows and constraints that matter in your own environment.
| Area | ens0key approach | Verify in the pilot |
|---|---|---|
| Renewal | Issue → deploy → verify → rollback | An actual renewal and a deliberately failed verification |
| Certificate authorities | Internal CA and external connectors | Your CA version and the operations you need |
| Deployment | On your infrastructure; pull agents over mTLS | Network routes, permissions and target stores |
| Governance | RBAC, audit and approvals | Your identity provider, role mapping and audit export |
| Operations | Go server and PostgreSQL | Sizing, backup, restore and your availability requirements |
Choosing by scenario — honestly
Everything between the extremes is exactly where ens0key fits best.
What ens0key brings together
Renewal with a safety net
Post-deploy TLS verification with automatic rollback, built into the product: the agent proves the new certificate is actually serving, or restores the previous one.
PKI in the box
A real issuing CA with CRL and OCSP responder: internal PKI without buying or running a second product.
A small footprint for isolated environments
One Go binary + PostgreSQL, licensing verified fully offline (Ed25519), air-gap friendly, no phone-home.
A vendor you can reach
Store and CA integrations developed per customer and per use case, and maintained when third-party versions change. EN / HR / DE interface.
Compare us on your own infrastructure
- 01Request a trial: all features for 30 days or 10 issued certificates, subject to manual approval
- 02Guided POC: your network scanned and one service on verified auto-renewal
- 03An expired license never holds your data hostage — inventory, monitoring, discovery and reports keep working