myOwnCA By EnigmaIS

MYOWNCA / DOCUMENTATION

How myOwnCA works

Explore key protection, your certificate authority, practical uses, and the certificate lifecycle in one interactive product map.

See how myOwnCA
fits together.

From protected signing keys to trusted connections. Explore the whole project, from setup to everyday certificate management.

Explore the interactive map Read the trust hierarchy
Project map showing key protection, the offline root and issuing CA, certificate holders, practical uses, and the certificate lifecycle.
The whole picture, from key protection to everyday operation. Open the interactive map to zoom in or read each section.
  1. 01 / Keys

    Protect your signing key

    Choose cloud, supported hardware, or encrypted local storage.

  2. 02 / CA

    Run your own CA

    Keep the root offline and manage your issuing CA in the browser.

  3. 03 / Uses

    Build trusted connections

    Issue certificates for people, devices, services, and partners.

  4. 04 / Lifecycle

    Manage every stage

    Request, approve, issue, deliver, renew, and revoke.

THE PROJECT MAP

How myOwnCA works

Choose key protection, run your own issuing CA, and issue certificates for trusted connections. Manage requests, approvals, delivery, renewal and revocation from the browser.

100%
How myOwnCA worksChoose key protection, run your own issuing CA, and issue certificates for trusted connections. Manage requests, approvals, delivery, renewal and revocation from the browser. The root stays offline. Applications must trust your CA and check revocation status. Read the accompanying explanation for details. Your certificate authority, from key protection to everyday use Your infrastructure. Your signing keys. Browser-based certificate management. 01 / KEY PROTECTION 02 / YOUR OWN CA ISSUED TO 03 / PRACTICAL USES Cloud vaultAWS KMS or Azure Key VaultProvider-held signing keySmartCard-HSMAlso Nitrokey HSMPKCS#11 / OpenSCStandalone deploymentUpcoming hardwareYubiHSM 2: unvalidatedThales Luna: in developmentEnterprise target: Q1 2027Encrypted local keysSoftware signingA simple starting pointProtect and back up secretsOffline root CASigns the issuing CARoot key stays offlinemyOwnCA issuing CAIssue, renew and revokeUse your selected signing keyPublish CRLs; optional OCSPBrowser portalsAdministrators and operatorsUsers and auditorsApprovals & auditConfigurable approval quorumOptional dual-control governanceTamper-evident audit recordsPeopleStaff and contractorsDevicesWorkstations andcompatible devicesServicesWeb, mail andVPN endpointsExternal partnersPartners and suppliersmTLS accessClient-certificate checksAt a compatible gatewaySecure email (S/MIME)Sign and encrypt emailWith compatible mail clientsWi-Fi & VPNCertificate-based loginWith compatible infrastructureServer HTTPSTLS for your own servicesOn clients that trust your CARequestPortal requestUpload a CSR oruse approvedgenerated keysApproveDistinct operatorsReview the requestMeet the configuredapproval quorumIssueSign with yourselected backendRecord identityand audit eventsDeliverExport or claimSupported formatsConfigured securedelivery channelsRenewExpiry remindersRenew eligibleprivate certificatesin their lineageRevokePublish CRLsOCSP if configuredRelying servicesmust check status key Manual handoff Deploy standalone or with Docker Compose. Host-attached PKCS#11 tokens require standalone deployment. 04 / THE CERTIFICATE LIFECYCLE External ACME is a separate lane The outbound ACME client obtains and automatically renews certificates from external certificate authorities. Trust and access enforcement need configuration Distribute your root certificate and configure relying services to check revocation. Access changes depend on those checks.

Drag to pan. Pinch or scroll to zoom. Keyboard: + / −, arrows, 0 to fit, Escape to close.

Open standalone SVG ↗

Explore in detail

Key protection

Compare encrypted software storage, supported hardware, and cloud signing.

Architecture

Understand the offline root, online issuing CA, trust hierarchy, and deployment boundaries.

Use cases

Put certificates to work for services, devices, and people.

Certificate lifecycle

Follow requests, approvals, issuance, delivery, renewal, and revocation.

Planning a deployment?

Talk to EnigmaIS