Documentation

Start with your trust boundary.

myOwnMDM is a self-hosted device certificate authority and enrolment portal. A dedicated, name-constrained sub-CA issues endpoint credentials, while your root or parent issuing authority stays separate from everyday enrolment.

myOwnCA is the natural companion for signing the sub-CA through an offline ceremony. A suitable alternative CA can also sign it. Read the architecture before choosing your deployment.

What it does today.

• Device-bound, expiring enrolment tokens; SCEP and REST certificate issuance.
• Signed Apple configuration profiles, Windows PowerShell enrolment, Android protected PKCS#12 credentials, and compatible generic clients.
• EAP-TLS Wi-Fi and IKEv2 VPN configurations, delivered through platform-specific workflows.
• Certificate inventory, activity, SCEP renewal, expiry visibility, suspension, release, revocation, CRL, and OCSP.
• Administrator, operator, and auditor roles; optional per-account TOTP and recovery codes.
• SQLite or optional MariaDB, configured email reminders, and optional external syslog.

myOwnMDM does not currently provide remote lock, wipe, application management, or push-based policy control. A minimal MDM layer is a conditional future direction, without committed scope or release dates. See the future direction.

Access and licensing.

No public software release is available yet. Early-access eligibility, device limits, and genuine noncommercial evaluation terms are agreed individually. Every commercial deployment, including a business pilot, requires paid terms.

Supplied EnigmaIS source is available for inspection. Source modifications and derivative versions are prohibited under both free and paid terms. Normal settings, supported APIs, and deployment configuration remain permitted; third-party components retain their own licences.

Request early access · Read the policy summary · EnigmaIS launch policy