Features
Everything in ens0key is available through the REST API: the web UI and CLI are equal-standing clients on top of it.
Certificate lifecycle (CLM)
From first discovery to retirement: a complete, deduplicated picture of your certificate estate.
Discovery
TLS scanning of targets and CIDR ranges (up to 4096 addresses), ad-hoc and on a schedule — plus agent-side discovery for networks the server cannot reach.
Inventory
Deduplication by SHA-256 fingerprint, observation history of where and when a certificate was seen, and source tracking for every entry.
Import
PEM and PKCS#12 (.pfx) via UI, API, or CLI — purchased certificates ready for on-prem distribution.
Metadata & collections
Centrally defined, searchable fields (owner, application…) and collections as saved queries over the inventory.
Flags
Automatic flagging: expired, expiring soon, self-signed, weak key, SHA-1 signature.
Alerts & notifications
Slack-compatible webhooks plus an e-mail channel: daily expiry digest and lifecycle event mails (SMTP, STARTTLS/TLS).
Dashboard
Expiry heatmap, CA breakdown, and key-strength report — inventory health at a glance.
Lifecycle timeline
Each certificate's detail view tells its story in order: issued, discovered, deployed, renewed (with a link to the successor), revoked, expires.
PKI automation
Run your own CA or drive external ones: issuance, renewal, and revocation through one gateway.
CA connectors
Internal issuing CA with a real CRL and OCSP responder; ACME (RFC 8555, HTTP-01); DigiCert CertCentral; EJBCA — issuance, renewal, revocation.
Key vault
Private keys encrypted with an envelope scheme (AES-256-GCM, per-key DEK), ready for KMS/HSM integration.
Agents
Pull-model orchestrators with mTLS: PEM/PKCS#12/JKS/IIS stores, auto-renewal with reload hooks, service verification, and blueprints for mass rollout — no inbound connections, works behind NAT.
Agentless deploy
Push and renew certificates straight from the server, without an agent: F5 BIG-IP, Cisco ISE/ESA/WLC, Fortinet FortiGate, Citrix NetScaler, plus Azure Key Vault, AWS ACM and GCP Certificate Manager.
SCEP / EST
Built-in enrollment servers for devices and MDM: EST (RFC 7030) over mTLS, and SCEP (RFC 8894) with an RSA RA and challenge, issuing from an internal CA.
Locations
One index of where every certificate is installed, across agent stores and agentless connectors, with per-row deploy status and a serving/problem verification signal.
Approvals
A single inbox for everything that needs a decision: pending enrollment requests and waiting workflow instances, each with Approve/Deny.
Platform & security
The controls your security team expects come built into the product.
SSO
OIDC sign-in (generic + Microsoft Entra ID preset) next to LDAPS and the local admin.
RBAC
Viewer, operator, and admin roles mapped from LDAP/SSO groups or users, enforced server-side.
Audit log
Every mutation and login attempt recorded.
Backup & restore
Named repositories (local/SFTP/SCP/TFTP), scheduled or manual dumps, optional AES-256-GCM encryption, transactional in-app restore.
Web UI
React SPA served from the same binary; dark and light themes, HR/EN, searchable in-app help.