myOwnCA By EnigmaIS
INDEPENDENT BY DESIGN

Your certificates.
Your keys.
Your control.

A private certificate authority that belongs to you. Bring clarity to your PKI, keep your keys close, and build trust on your own terms.

Try myOwnCA Explore the platform

In development. Free for non-commercial use within product restrictions.

FROM PROTECTED KEYS TO TRUSTED CONNECTIONS

Offline root CA

Your foundation of trust

OFFLINE

Manual signing and certificate transfer

Protect the issuing keyCloud · HSM · Encrypted file
myOwnCA

Your online issuing certificate authority

Request. Approve. Issue. Renew. Revoke.
ServicesmTLS & HTTPS
Services / IN PRACTICE

Your apps deserve another layer of protection.

Exposing a dashboard, home server, or business application through a tunnel? Even trusted third-party software can have vulnerabilities. Add defense in depth: require a trusted client certificate at a compatible access gateway before requests reach your application. Issue and manage those certificates with myOwnCA.

  1. Client certificate
  2. Access check
  3. Private app

Your access gateway must support and enforce client-certificate authentication at the visitor’s TLS connection.

Explore this use case
DevicesDevice identity
Devices / IN PRACTICE

From the shelf to a trusted connection.

Preparing payment terminals or kiosks for deployment? Give each compatible device its own certificate during staging. When it connects after storage, your provisioning service can verify that identity before releasing configuration.

  1. Device request
  2. Certificate issued
  3. Identity verified

Requires device and provisioning software that support certificate authentication.

Explore this use case
PeopleSecure email
People / IN PRACTICE

Make your team’s email verifiable.

Help colleagues verify who sent a message and whether it changed in transit. Issue individual S/MIME certificates with myOwnCA and use them to sign email in compatible mail clients.

  1. Personal certificate
  2. Signed email
  3. Verified signature

Recipients’ mail clients must trust your organization’s CA to verify the signature’s certificate.

Explore this use case
An offline root. Protected issuing keys.
Certificates for services, devices, and people.
PRIVATE PKI. WITHOUT THE GUESSWORK.A closer look
Self-hosted by you Offline-root capable Hardware & cloud keys Managed in your browser

What is myOwnCA?

Your own certificate authority, right in your browser.

Watch the introduction

Watch on YouTube

01 / USE CASES

Put your certificates
to work.

An extra check before an app opens. An identity for every device. A signature your team can verify.

ServicesTLS certificates

Your apps deserve another layer of protection.

Exposing a dashboard, home server, or business application through a tunnel? Even trusted third-party software can have vulnerabilities. Add defense in depth: require a trusted client certificate at a compatible access gateway before requests reach your application. Issue and manage those certificates with myOwnCA.

  1. Client certificate
  2. Access check
  3. Private app

Your access gateway must support and enforce client-certificate authentication at the visitor’s TLS connection.

DevicesDevice identities

From the shelf to a trusted connection.

Preparing payment terminals or kiosks for deployment? Give each compatible device its own certificate during staging. When it connects after storage, your provisioning service can verify that identity before releasing configuration.

  1. Device request
  2. Certificate issued
  3. Identity verified

Requires device and provisioning software that support certificate authentication.

PeopleUser certificates

Make your team’s email verifiable.

Help colleagues verify who sent a message and whether it changed in transit. Issue individual S/MIME certificates with myOwnCA and use them to sign email in compatible mail clients.

  1. Personal certificate
  2. Signed email
  3. Verified signature

Recipients’ mail clients must trust your organization’s CA to verify the signature’s certificate.

Documentation

02 / PROJECT MAP

See how myOwnCA
fits together.

From protected signing keys to trusted connections. Explore the whole project, from setup to everyday certificate management.

Explore the interactive map Read the architecture guide
Project map showing key protection, the offline root and issuing CA, certificate holders, practical uses, and the certificate lifecycle.
The whole picture, from key protection to everyday operation. Open the interactive map to zoom in or read each section.
  1. 01 / Keys

    Protect your signing key

    Choose cloud, supported hardware, or encrypted local storage.

  2. 02 / CA

    Run your own CA

    Keep the root offline and manage your issuing CA in the browser.

  3. 03 / Uses

    Build trusted connections

    Issue certificates for people, devices, services, and partners.

  4. 04 / Lifecycle

    Manage every stage

    Request, approve, issue, deliver, renew, and revoke.

THE PROJECT MAP

How myOwnCA works

Choose key protection, run your own issuing CA, and issue certificates for trusted connections. Manage requests, approvals, delivery, renewal and revocation from the browser.

100%
How myOwnCA worksChoose key protection, run your own issuing CA, and issue certificates for trusted connections. Manage requests, approvals, delivery, renewal and revocation from the browser. The root stays offline. Applications must trust your CA and check revocation status. Read the accompanying explanation for details. Your certificate authority, from key protection to everyday use Your infrastructure. Your signing keys. Browser-based certificate management. 01 / KEY PROTECTION 02 / YOUR OWN CA ISSUED TO 03 / PRACTICAL USES Cloud vaultAWS KMS or Azure Key VaultProvider-held signing keySmartCard-HSMAlso Nitrokey HSMPKCS#11 / OpenSCStandalone deploymentUpcoming hardwareYubiHSM 2: unvalidatedThales Luna: in developmentEnterprise target: Q1 2027Encrypted local keysSoftware signingA simple starting pointProtect and back up secretsOffline root CASigns the issuing CARoot key stays offlinemyOwnCA issuing CAIssue, renew and revokeUse your selected signing keyPublish CRLs; optional OCSPBrowser portalsAdministrators and operatorsUsers and auditorsApprovals & auditConfigurable approval quorumOptional dual-control governanceTamper-evident audit recordsPeopleStaff and contractorsDevicesWorkstations andcompatible devicesServicesWeb, mail andVPN endpointsExternal partnersPartners and suppliersmTLS accessClient-certificate checksAt a compatible gatewaySecure email (S/MIME)Sign and encrypt emailWith compatible mail clientsWi-Fi & VPNCertificate-based loginWith compatible infrastructureServer HTTPSTLS for your own servicesOn clients that trust your CARequestPortal requestUpload a CSR oruse approvedgenerated keysApproveDistinct operatorsReview the requestMeet the configuredapproval quorumIssueSign with yourselected backendRecord identityand audit eventsDeliverExport or claimSupported formatsConfigured securedelivery channelsRenewExpiry remindersRenew eligibleprivate certificatesin their lineageRevokePublish CRLsOCSP if configuredRelying servicesmust check status key Manual handoff Deploy standalone or with Docker Compose. Host-attached PKCS#11 tokens require standalone deployment. 04 / THE CERTIFICATE LIFECYCLE External ACME is a separate lane The outbound ACME client obtains and automatically renews certificates from external certificate authorities. Trust and access enforcement need configuration Distribute your root certificate and configure relying services to check revocation. Access changes depend on those checks.

Drag to pan. Pinch or scroll to zoom. Keyboard: + / −, arrows, 0 to fit, Escape to close.

Open standalone SVG ↗

03 / THE PLATFORM

Serious PKI.
A clearer way to run it.

From the first request to the final revocation, give every certificate a well-managed life. All from your browser. All on your infrastructure.

The whole lifecycle.
One place to manage it.

Issue, renew, export, and revoke. Bring your certificates into a workflow your team can actually follow.

Trust is a team decision.

Separate responsibilities with four roles, configurable approval quorum, and single-administrator or dual-control governance.

Your keys. Your choice.

Protect signing keys with software, a PKCS#11 HSM, AWS KMS, or Azure Key Vault.

Built around your security model

Stay ahead of expiry.

Keep track of certificate lifecycles with renewal workflows, automatic expiry reminders, and external ACME renewal.

A lifecycle, not a spreadsheet

Accountability, built in.

Trace actions through a tamper-evident audit log. Publish revocation status through CRLs and OCSP.

Visibility from issue to revocation
View all features

Using a host-attached HSM or smart card? Choose the standalone deployment for PKCS#11 access.

04 / THE FOUNDATION

A clear chain of trust.
From the ground up.

Keep the root protected. Let your issuing CA handle the everyday. Give your team the right level of control.

01

Protect your root.

Keep your root CA air-gapped. Sign the issuing CA through an offline ceremony, with the root private key off the issuing-CA host.

THE TRUST ANCHOR
02

Activate your private issuing CA.

Place your issuing CA on your private network. Guided setup connects your signing keys and activates the issuer. You control network placement, access, and any outbound connections.

YOUR PRIVATE CA
03

Make trust an everyday thing.

Manage requests, approvals, certificate delivery, and revocation in role-specific browser portals.

THE EVERYDAY WORKFLOW

Just exploring? Test/Lab mode creates a local root and issuing CA for evaluation. Production uses the offline-root workflow.

Start here

05 / SECURITY BY DESIGN

Built around established
PKI practices.

Practical controls for how your team protects keys, shares responsibility, and manages trust.

Further reading: NIST SP 800-57 Part 1

  • Keep the root offline.

    Sign the issuing CA through an offline ceremony. Keep the root private key away from the issuing service.

  • Separate roles and approvals.

    Four roles, configurable approval quorum, and dual-control governance let you share responsibility.

  • Protect your signing keys.

    Choose encrypted software keys, a supported PKCS#11 device, AWS KMS, or Azure Key Vault.

  • Keep an auditable lifecycle.

    Trace certificate operations through a tamper-evident audit log, from issuance to revocation.

OWN THE FOUNDATION

Your infrastructure.
Your policies. Your peace of mind.

For the home lab you've built.
For the business you're building.
Trust should belong to you.

06 / ROOM TO GROW

Start small.
Keep your ambitions big.

Explore at home. Put it to work in your business. The same foundation, with room for more identities.

PERSONAL & EDUCATION

Make it your own.

Freefor non-commercial use

For personal projects, learning, and non-commercial evaluation.

10active certificate identitiesGenuine renewals keep the same identity slot.
  • Browser-based certificate management
  • Offline-root & protected-key support
  • Renewal, revocation & audit capabilities
Explore myOwnCA
FOR YOUR BUSINESSBUILT TO GROW

Your next chapter.

Let's talk.Commercial licensing

Every commercial use requires a paid license, even within the 10-identity allowance. Agree capacity and terms for your organization.

More identities.The same control over your infrastructure.
  • Licensed for commercial use
  • Higher certificate-identity limits
  • Offline, installation-bound license verification
Talk to EnigmaIS

Renewals, revocation, monitoring, export, audit, and recovery are not gated by paid capacity.

Source is available for inspection. Modifying EnigmaIS source or creating derivative versions is prohibited under both free and paid terms. Normal settings, supported APIs, and deployment configuration remain permitted. Read the launch licensing policy summary; full product terms will accompany the first distribution.

07 / A LITTLE MORE CLARITY

Good questions.
Straight answers.

Something else on your mind?

Get in touch
Can I modify the source or create a derivative version?

No. EnigmaIS source is available for inspection, but source modifications and derivative versions are prohibited under both free and paid terms. Normal settings, supported APIs, and deployment configuration remain permitted. Third-party components retain their own licenses.

What is myOwnCA?

myOwnCA is a self-hosted private certificate authority for small and medium-sized organizations and home labs. It brings certificate requests, approvals, issuance, renewal, and revocation into a guided browser-based workflow, while you control the infrastructure and signing keys.

Will browsers automatically trust my certificates?

Certificates issued by your private CA are trusted by devices and applications where you have installed your root certificate. myOwnCA does not distribute that trust anchor for you. For publicly trusted service certificates, it also includes an outbound ACME client for external certificate authorities.

Can I keep my root certificate authority offline?

Yes. Production setup supports an air-gapped root that signs your issuing CA through an offline ceremony. The root private key stays off the issuing-CA server. A separate Test/Lab installation mode can create a local root and issuing CA for evaluation.

Do I need a hardware security module?

No. You can use encrypted software-held signing keys, or configure AWS KMS or Azure Key Vault. For a host-attached PKCS#11 HSM or smart card, use the supported standalone deployment. The supplied Docker Compose setup uses software-held keys by default and does not include local PKCS#11 passthrough.

What counts toward the 10-identity allowance?

Each first issuance starts a certificate identity, also called a lineage. It counts while any certificate in that lineage is active and unexpired. A genuine renewal stays in the same lineage, including during key rotation, so renewal overlap does not consume another slot. Changing the certificate identity creates a new lineage. External or imported service certificates do not count.

How does commercial licensing work?

The free offering is for non-commercial personal, educational, and evaluation use. Every commercial use requires a paid license, even within the free capacity limit. Source is available for inspection; modifications and derivative versions are prohibited under both free and paid terms. Normal settings, supported APIs, and deployment configuration remain permitted. An installation-bound license raises the certificate-identity allowance and is verified offline. Renewals, monitoring, revocation, export, audit, and recovery are not gated by paid capacity. Contact info@enigmais.com to discuss your requirements.

THE NEXT STEP IS YOURS

Make trust
your own.

Your private CA. Your own infrastructure.
A clearer way to manage the certificates that matter.

Let's get you started info@enigmais.com
SELF-HOST WITH DOCKER
PUBLIC IMAGE AVAILABLE

Ready for your infrastructure.

Pull myOwnCA 0.12.4 from GitHub Container Registry. Choose the image for your architecture.

unknown
docker pull ghcr.io/enigmais/myownca:0.12.4
ARM64
docker pull ghcr.io/enigmais/myownca:0.12.4-arm64
AMD64
docker pull ghcr.io/enigmais/myownca:0.12.4-amd64
View on GitHub Container Registry
Your server. Your data. Your control.