Getting started

Signing in

Open https://<your-server> and sign in with your username and password (local admin or LDAP), or a Sign in with … button if SSO is configured. Your role decides what you see: viewers read, operators manage certificates, admins also get Administration and Backup.

The dashboard

The landing page is a health overview: totals (expiring in 30 days, expired, weak keys), an expiry heatmap — one cell per week for the next 12 months — and breakdowns by issuer and key strength (weak: RSA < 2048, ECDSA < 256).

Building the inventory

Inventory is the central list, deduplicated by SHA-256 fingerprint. Three ways to fill it:

• ▸Ad-hoc scan — type host:port (or several, comma-separated) and Scan: whatever TLS certificate those endpoints present lands in the inventory, valid or not.
• ▸Scheduled discovery — Discovery → Scan targets scans endpoints and CIDR ranges on a schedule; agents can scan networks the server cannot reach.
• ▸Import — load a PEM or PKCS#12 (.pfx) file; with the password, the private key is stored encrypted in the vault.

Search by CN, issuer, SAN, fingerprint or metadata; filter by status. Save any search as a collection — collections scope alerts, reports and permissions.

Issuing a certificate

Enroll → Issuance groups the form into authority/template, identity, and key/validity. Pick a configured CA, enter the Common Name, separate DNS and IPv4/IPv6 SANs, key algorithm and validity, then Issue. The steps stream live (e.g. ACME order → challenge → validation → download). ens0key generates the key and CSR server-side; the key is offered for download exactly once, then kept encrypted in the vault. For Microsoft ADCS, select a template suggestion or type its published internal name. Suggestions are not continuously refreshed.

If the CA has an issuance policy, a request that breaks it (wrong CN pattern, SAN outside the allowed domains, validity too long, missing required metadata) is refused with the reason. If approval is enabled, the request waits in the Approvals inbox until an operator approves it.

Choose ECDSA P-256 (default), RSA-2048, RSA-3072 or RSA-4096. The leaf key choice does not change the issuing CA’s signing algorithm. ADCS template and CA policy determine the actual certificate lifetime. Follow the ADCS setup guide before your first Windows CA request.

Reading certificate details

Open an inventory row to see identity and SANs, validity, public key, signature and private-key availability first. The wider panel keeps its heading and close control visible while you scroll. Service evidence appears before deployment and ownership. Expand history, technical identifiers or the public PEM only when needed; deletion is at the bottom.

Renew, renew everywhere, revoke

Open any certificate from the inventory for the detail view:

• ▸Renew issues a fresh certificate with the same subject and SANs, generating a new key while preserving the previous key algorithm and size.
• ▸Renew everywhere reissues and re-pushes to previously successful explicit deployments. Discovery observations do not authorize key delivery; without a confirmed destination the operation stops before issuance. The old certificate is marked superseded (it stays valid until expiry — renewal is not revocation).
• ▸Revoke publishes internal-CA revocation through CRL and OCSP. Unsupported external revocation returns an error without changing the local revoked flag. Use the issuer portal for unsupported ACME, EJBCA or DigiCert revocation.

Serve the UI with your own certificate

Issue a certificate from your internal CA with the CN and SAN set to the server's real FQDN/IP, then pick it under Settings → Access & security → Platform HTTPS. It is served immediately — no restart.