Installation

What you need

• ▸The appliance image for your hypervisor — .ova (VMware/ESXi), .vhdx (Hyper-V), or .qcow2 (Proxmox/KVM). You receive a download link with your trial or license.
• ▸2 vCPU / 4 GB RAM / 50 GB disk as the floor; DHCP or a reserved IP on the network you attach it to.
• ▸A DNS name for the server (e.g. pki.example.com) — agents and browsers will verify the TLS certificate against it.

Import and boot

VMware (vSphere / ESXi)

Deploy OVF Template → select the .ova. Give it a network with DHCP or a reserved IP.

Microsoft Hyper-V

New → Virtual Machine → Generation 1, attach the .vhdx as the disk, connect a virtual switch. Generation 2 works too if you disable Secure Boot.

Proxmox VE

The image is BIOS-based: create the VM with the defaults (Machine i440fx, BIOS SeaBIOS) and SCSI Controller VirtIO SCSI single, then import the qcow2 as its disk:

# create an empty VM shell (VMID 107 here; vmbr0 = your bridge)
qm create 107 --name ens0key --memory 4096 --cores 2 --ostype l26 \
  --scsihw virtio-scsi-single --net0 virtio,bridge=vmbr0 --agent 1

# import the disk into your storage (check names with pvesm status)
qm importdisk 107 /root/ens0key-<version>.qcow2 local-lvm

# attach the volume importdisk printed, boot from it, start
qm set 107 --scsi0 local-lvm:vm-107-disk-0
qm set 107 --boot order=scsi0
qm start 107

Then open the VM Console (noVNC). Resize the disk later with qm resize 107 scsi0 +20G if needed. Plain KVM/libvirt also works: virt-install --import with the qcow2 (BIOS, virtio disk and network).

First-boot wizard

The appliance boots straight into a console wizard. It asks five things:

1. 01Hostname — e.g. pki.example.com.
2. 02Network — DHCP, or a static IP/CIDR with gateway and DNS.
3. 03Admin password — for the UI/API user admin. The wizard also generates the database password and the vault master key.
4. 04OS/SSH password — for the ens0key Linux user, used for the console/SSH ops tools and troubleshooting.
5. 05Confirm — the wizard writes the configuration, starts the stack, and disables itself. It prints the URL to open.

Open https://<ip>, accept the temporary self-signed certificate, and sign in as admin. To change the network or hostname later, re-run sudo /opt/ens0key/firstboot.sh --force — secrets are not touched.

Real TLS certificate

The appliance starts on a self-signed certificate. Replace it before going live — pick one of three ways:

• ▸From the GUI (recommended): issue or import a certificate into the inventory (with its private key), then System → GUI certificate → pick it. It is served immediately via a runtime swap, no restart, and persists.
• ▸Console helper: copy the pair to the appliance and run sudo ens0key-set-tls fullchain.pem key.pem. Re-run to rotate.
• ▸Manually: point ENS0KEY_TLS_CERT / ENS0KEY_TLS_KEY in /opt/ens0key/.env at your PEM pair.

Alternative: Docker Compose or binaries

Prefer your own infrastructure conventions? The same stack runs as Docker Compose (server + PostgreSQL, one port for API and UI) or as a single Go binary with your own PostgreSQL — the appliance is convenience, not a requirement. The compose bundle ships with the release archive.

Trial and license

A fresh install starts a trial automatically: every feature, for 30 days or 10 issued certificates, whichever comes first. To activate, upload your signed .lic file under System → License — verification is fully offline (Ed25519), no phone-home. If a license lapses, read-only inventory, monitoring, discovery and reports keep working; only issuance, renewal and deployment pause.