- Overview
- Reference Guide
- Setup & Architecture
- Release Notes
- Workflow
- API Reference
- Integration Guide
- Discovery Agent Setup Guide
Discovery
CertSecure's Certificate Discovery section provides users with the ability to configure, run and analyze certificates on their network, windows and linux stores providing valuable insights into the certificates across their infrastructure. It offers an organized and seamless approach to certificate management by discovering certificates proactively, identifying risks, and generating insightful analytics. It also provides the capability to ingest and provide analytical insights from discovery data generated by third-party tools.
You can download the Discovery Agent for Windows and Linux from CertSecure Manager by navigating to Utilities > Agents, then selecting Discovery Agent and clicking on Download. This will display options to download the agent for both operating systems.
The Certificate Discovery section is divided into seven key functional areas:
- Inventory
- Scan Config
- Cloud Config
- Vault Config
- Discovery Analytics
- Scan Details
- Discovery Ingestion
Deleting a Scan Configuration
Deleting a scan configuration also deletes the certificates that the scan discovered. A configuration cannot be deleted on its own, so the Discovery Inventory never keeps certificates that are attributed to a scan that no longer exists. Deleting a scan requires the Manage Discovery permission.
To delete a scan, right-click it in the Scan Configuration table, select Delete Config, and confirm the deletion. A scan can own a large number of certificates, so the deletion runs in the background:
- A Deleting Scan panel opens at the top right of the screen with a progress bar. The panel can be closed while the deletion continues, and it opens again if the page is reloaded before the deletion has finished.
- When the deletion is complete, the panel changes to Scan Deleted and reports how many discovered certificates were deleted with the scan. Show Details opens the Scan Deletion Details window, which lists the Scan Config Name, the Total Deleted Certs, and the Notified Users.
What the deletion does, in order:
- Cancels every future scheduled run of the scan. The run history of the scan is kept on the Task page, but it is no longer shown under Scan Details.
- Deletes the certificates discovered by the scan from the Discovery Inventory, in batches, and removes the analytics of the scan.
- Deletes the scan configuration. This is the last step, so a deletion that stops part-way leaves the configuration in place and can be started again.
- Sends an email to the people responsible for the deleted certificates.
Restrictions
-
A scan that has a run pending or in progress cannot be deleted. Wait for the run to finish and delete the scan again.
- While a scan is being deleted it cannot be edited or run, and Delete Config is not available for it.
- At most three scan deletions run at the same time across CertSecure Manager. Start the deletion again after a few minutes if the limit has been reached.
- A deletion that stops reporting progress for 10 minutes is marked as failed and the scan is unlocked. Certificates that were already removed stay removed; delete the scan again to finish.
- The progress of a deletion can be read only by the user who started it or by an Admin.
Notification emails
Each owner of a deleted certificate receives one email, with the subject Discovered Certificates Deleted followed by the scan name, listing all of their deleted certificates (Common Name, Serial Number, Issuer, Not After and Host). When a deleted certificate has no owner, the email goes to the members of its watcher groups instead. The Notified Users list in Scan Deletion Details shows the people who were emailed; an address marked (email not sent) could not be emailed.
If another scan discovers one of the deleted certificates again, the certificate returns to the Discovery Inventory as a new certificate without an owner or watcher group.