Encryption Consulting CertSecure Manager Setup Guide for CBOM PKI Sensor
1. Purpose
This guide describes how to configure the CBOM PKI sensor (Discover_PKI) to integrate with Encryption Consulting CertSecure Manager, a certificate lifecycle management platform. The sensor connects to the CertSecure REST API in read-only mode to discover and catalog cryptographic certificate assets across your PKI infrastructure.
The Discover_PKI sensor collects the following certificate metadata:
Subject DN — the distinguished name of the certificate subject
Subject Alternative Names (SANs) — DNS names, IP addresses, and email addresses
Validity period —
notBeforeandnotAftertimestampsIssuer DN — the issuing certificate authority
Key algorithm — RSA, ECDSA, or other algorithm identifier
Key size — bit length of the public key (e.g., 2048, 4096, 256)
No certificate private keys or secret material are accessed. All API calls are read-only and scoped to the certificate inventory endpoint.
2. Prerequisites
Before beginning this setup, ensure the following are in place:
Access to the CertSecure Manager admin console with an account that has the Super Admin or User Administrator role.
CertSecure Manager version 4.2.0 or later (REST API v1 required).
Network connectivity from the CBOM sensor host to the CertSecure Manager API endpoint on port 443 (HTTPS).
The CBOM sensor agent installed and running on the designated host. Refer to the CBOM Sensor Installation Guide if the agent is not yet installed.
A valid TLS certificate on the CertSecure Manager instance, or the internal CA certificate available to configure trust on the sensor host.
Outbound firewall rules permitting HTTPS traffic from the sensor host to the CertSecure Manager FQDN.
3. Create a CertAuditor Service Account
The CBOM sensor requires a dedicated service account with the built-in CertAuditor role, which grants read-only visibility into the certificate inventory without allowing any modifications.
3.1 Log In to the CertSecure Manager Admin Console
-
Open a browser and navigate to your CertSecure Manager instance:
https://<certsecure-manager-hostname>/admin Enter your administrator credentials and click Sign In.
After login, confirm you are on the Dashboard page. The top navigation bar should display Admin, Certificates, Templates, and Reports menus.
3.2 Create the Service Account
In the top navigation bar, click Admin, then select Users & Roles.
On the Users tab, click Add User.
Fill in the following fields: | Field | Value | |---|---| | Username |
cbom-certsecure-svc| | Email |cbom-svc@<your-domain>.com| | First Name |CBOM| | Last Name |Service| | Role |CertAuditor| | Account Type |Service Account| | Status |Active|Uncheck Require password change on first login — service accounts do not use password-based login.
Click Save. The new service account appears in the Users list.
Confirm the account row shows Role: CertAuditor and Status: Active.
4. Generate an API Key for the Service Account
CertSecure Manager authenticates API requests using an X-API-Key header. Each service account can hold one active API key at a time.
4.1 Navigate to API Key Management
In the top navigation bar, click Admin, then select API Keys.
The API Keys page lists all existing keys, the associated user account, creation date, and last-used timestamp.
4.2 Generate the Key
Click Generate Key.
-
In the Generate API Key dialog, select the service account created in Section 3:
cbom-certsecure-svc -
Enter a description to identify the key:
CBOM PKI Sensor - Read-Only Access Set an Expiry date if your security policy mandates key rotation. Leave blank for a non-expiring key and manage rotation manually per Section 9.
Click Generate.
-
Copy the displayed API key immediately — it is shown only once:
csm_apk_4f8a2e1b7c3d9056ae12f3b84c71d02e Store the key in a secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager) before closing the dialog. CertSecure Manager does not redisplay the key after this step.
5. Verify API Access
Before configuring the sensor, confirm that the API key grants the expected read-only access to the certificate inventory endpoint.
5.1 Test the Certificates Endpoint
From the sensor host (or any host with network access to CertSecure Manager), run the following command:
curl -s -o /dev/null -w "%{http_code}" \
-H "X-API-Key: csm_apk_4f8a2e1b7c3d9056ae12f3b84c71d02e" \
"https://<certsecure-manager-hostname>/api/v1/certificates?limit=1"A successful response returns HTTP 200. If you receive 401 or 403, re-verify the API key and role assignment before proceeding.
5.2 Inspect a Sample Response
curl -s \
-H "X-API-Key: csm_apk_4f8a2e1b7c3d9056ae12f3b84c71d02e" \
"https://<certsecure-manager-hostname>/api/v1/certificates?limit=1" \
| python3 -m json.toolThe response should contain a JSON array with certificate objects including fields such as subject, sans, notBefore, notAfter, issuer, keyAlgorithm, and keySize. Confirm all expected fields are present before continuing.
6. Configure CBOM Sensor
Add the CertSecure Manager connection to the CBOM sensor configuration file. The default configuration file path is /etc/cbom/sensors.yaml.
sensors:
- name: Discover_PKI
type: pki
enabled: true
schedule: "0 2 * * *" # Run daily at 02:00 UTC
source:
provider: certsecure_manager
endpoint: "https://certsecure-manager.internal.example.com"
api_version: v1
tls:
verify: true
ca_bundle: "/etc/cbom/certs/certsecure-ca.pem" # Remove if using a public CA
auth:
method: api_key
header: X-API-Key
secret_ref: "cbom/certsecure/api-key" # Path in secrets manager
discovery:
include_expired: false # Set true to include expired certificates in CBOM
include_revoked: false
page_size: 500
timeout_seconds: 60
filters:
- field: status
operator: in
values:
- ACTIVE
- EXPIRING_SOON
output:
format: cbom_json
destination: cbom-collector
collector_endpoint: "https://cbom-collector.internal.example.com:8443"
collector_token_ref: "cbom/collector/token"
tags:
environment: production
sensor_owner: security-team
data_classification: internalAfter editing the configuration file, reload the CBOM sensor service:
sudo systemctl reload cbom-sensorVerify the sensor loaded without errors:
sudo systemctl status cbom-sensor7. Validation
After configuring and reloading the sensor, perform the following checks to confirm successful integration.
-
Check the sensor log for a successful initialization message:
sudo journalctl -u cbom-sensor -n 50 --no-pager | grep Discover_PKIExpected output:
INFO [Discover_PKI] Sensor initialized. Provider: certsecure_manager INFO [Discover_PKI] API connectivity check passed. Endpoint: https://certsecure-manager.internal.example.com -
Trigger a manual discovery run to verify end-to-end data flow:
cbom-ctl sensor run --name Discover_PKI -
Check the run summary:
cbom-ctl sensor status --name Discover_PKI --last-runExpected output:
Status: SUCCESS Certificates found: 1248 Duration: 14.3s Last run: 2026-06-29T02:00:07Z Log in to the CBOM dashboard and navigate to Assets > Certificates. Confirm that certificates from CertSecure Manager appear with the
sensor_owner: security-teamtag and that the subject, SANs, validity, issuer, key algorithm, and key size fields are populated correctly.
8. Common Errors and Resolution
Error 1: 401 Unauthorized on API call
HTTP/1.1 401 Unauthorized
{"error": "Invalid or missing API key"}Cause: The API key provided via secret_ref is incorrect, expired, or was regenerated after the sensor was first configured.
Resolution:
Log in to CertSecure Manager Admin > API Keys and verify the key exists and is associated with
cbom-certsecure-svc.If the key was rotated, retrieve the new key from your secrets manager and update the secret at the path specified in
secret_ref.Reload the sensor:
sudo systemctl reload cbom-sensor.
Error 2: TLS certificate verify failed
ERROR [Discover_PKI] TLS handshake failed: certificate verify failed (self-signed certificate in chain)Cause: The CertSecure Manager instance uses a certificate issued by an internal or private CA that is not trusted by the sensor host's default system trust store.
Resolution:
Export the internal CA certificate from your PKI in PEM format.
-
Copy it to the sensor host:
sudo cp internal-ca.pem /etc/cbom/certs/certsecure-ca.pem Confirm the
tls.ca_bundlepath insensors.yamlmatches the file location.Reload the sensor:
sudo systemctl reload cbom-sensor.
Error 3: 403 Forbidden — Insufficient permissions
HTTP/1.1 403 Forbidden
{"error": "Access denied. Required role: CertAuditor or higher"}Cause: The service account cbom-certsecure-svc was not assigned the CertAuditor role, or the role was removed after initial configuration.
Resolution:
Log in to CertSecure Manager Admin > Users & Roles.
Locate
cbom-certsecure-svcand click Edit.Confirm the Role field is set to
CertAuditor. Correct it if needed and click Save.Re-run the sensor:
cbom-ctl sensor run --name Discover_PKI.
9. Security Recommendations
Store API keys in a secrets manager. Never place the raw API key in the
sensors.yamlfile. Use thesecret_reffield to reference a key stored in HashiCorp Vault, AWS Secrets Manager, or an equivalent solution. Restrict access to that secret path to the CBOM sensor service account only.Rotate the API key on a defined schedule. Generate a new API key in CertSecure Manager at least every 90 days, or immediately whenever a team member with access to the secrets manager leaves the organization. Update the secret in your secrets manager and reload the sensor after each rotation.
Restrict network access. Apply firewall rules so that only the CBOM sensor host IP address is permitted to reach the CertSecure Manager API on port 443. This limits the exposure of the API endpoint and reduces the blast radius of a compromised key.
Enable TLS verification. Always set
tls.verify: truein the sensor configuration. Do not disable certificate validation in any environment, including staging or testing. If an internal CA is in use, provide the correctca_bundlepath instead.Audit API key usage periodically. Review the Last Used timestamp in CertSecure Manager Admin > API Keys. If the key has not been used recently, investigate whether the sensor is running as expected. If the key appears to have been called from an unexpected IP address, revoke it immediately, generate a replacement, and rotate the secret in your secrets manager.
10. Conclusion
This guide covered the end-to-end configuration required to connect the CBOM Discover_PKI sensor to Encryption Consulting CertSecure Manager. By creating a dedicated CertAuditor service account and scoped API key, the sensor obtains read-only access to the full certificate inventory without any risk of modifying PKI data. Once operational, the sensor continuously feeds certificate metadata — including subject, SANs, validity period, issuer, key algorithm, and key size — into the CBOM platform, enabling accurate cryptographic asset tracking and compliance reporting across your organization.