- Overview
- Reference Guide
- Setup & Architecture
- Release Notes
- Workflow
- API Reference
- Integration Guide
- Discovery Agent Setup Guide
Scan Configuration
The Scan Configuration section allows users to create and manage certificate discovery jobs across their environment. Each scan job can be configured to target either a Network, Store or Cloud Service based on the selected discovery Scan type.
For Network Discovery, users can define an IP Range, Subnet or URL and choose between standard, custom, or all ports to discover certificates. This ensures broad and flexible coverage across network segments and services.
For Store Discovery, users select between Windows, IIS CCS, JKS and Linux as the target platform. Windows based scans require the agent to be installed on a domain-joined machine with WinRM enabled. Linux scans involve discovering Linux hosts or manually adding target systems using SSH credentials.
The Cloud Discovery feature allows agentless scanning of cloud environments like Azure and AWS to identify associated certificates with active cloud assets and services. This helps in extending certificate visibility to workloads hosted in cloud environments. You need to first set up cloud provider details in the Cloud Config page.
The Container Discovery feature allows you to scan containerized environments like Docker Containers to identify certificates used by pods, etc. Users provide cluster connection details by adding a Linux host or discovering the Linux hosts, running the container, and the scan is performed.
The Vault Discovery feature enables scanning of secret managers like HashiCorp Vault and Azure Key Vault to locate certificates stored as secrets. You need to first configure the vault connection and authentication details on the Vault Config page before initiating a scan.
Alert Information
The Alert Information settings are common to every scan type. Whether you are configuring a Network, Store, Vault, Container, or Cloud scan, the same alerting options are available. Users can assign an owner on the Scan level, and they will receive alerts regarding that specific scan.
- Enable Alerts: Turn on notifications for important scan events such as scan completion or failure.
- Send Reports on run: Automatically send the scan report over email after every run to scan owner.
- Expiry Window, Days of Alert, and Per Day Alerts: Define how far ahead of expiry certificates are flagged, the days of the week on which alerts are sent, and the maximum number of alerts sent per day.
Alert settings can also be updated for several scan jobs at once. On the Scan Configuration page, select the required discovery instances and click Bulk Configuration to open the Bulk Scan Configuration window, where you can set the Owner Type and Owner Email and apply the same Enable Alerts, Send Reports on run, Expiry Window, Days of Alert, and Per Day Alerts values to all the selected scans in a single save.
Windows Configuration
For Windows Store Discovery, the scan is configured through the following fields:
- Configuration Type: Select Store to scan certificate stores on target machines.
- Store Type: Select Windows as the target platform. The discovery agent must be installed on a domain-joined machine with WinRM enabled..
- Host Filter Mode: Choose Include to scan only the specified targets, or Exclude to skip them.
- Inclusion / Exclusion Criteria: Specify the Organization Units (OUs) and/or Servers to include in or exclude from the scan, as comma-separated values.
- Store scope: Select Current User, Local Machine, or both, to define which Windows certificate stores are scanned.
Linux Configuration
For Linux Store Discovery, users can add individual or multiple hosts at once using the CSV Bulk Upload option. CertSecure Manager also provides you with an option to discover Linux Hosts on AWS for Certificate Discovery.
You can also add custom paths in Linux Store Scans when certificates are stored outside the default paths; the AD/SSSD account used for SSH access must be able to read the certificate files and traverse (execute permission) the directory and all its parent directories.
IIS CCS Configuration
JKS Configuration
For JKS Store Discovery, select Store as the Configuration Type and JKS as the Store Type, and then define the keystore details:
- JKS Host Type: Select whether the keystores are hosted on Windows or Linux machines. The host type is fixed when the scan is created and cannot be changed when the scan is edited.
- Keystore Password: Provide the password required to open the Java keystores that will be scanned. The password is optional. JKS and JCEKS keystores store their certificates unencrypted, so their certificates are inventoried even when the password is not known; a password is needed only to open PKCS12 keystores.
- Store Paths: The default paths C:\Program Files, C:\Program Files (x86), and C:\ProgramData are scanned automatically. You can add custom paths using the Add path option, or remove any path that is not required. These defaults apply when the JKS Host Type is Windows. When the JKS Host Type is Linux, the list is pre-filled with the Linux defaults listed below. The default lists are supplied by CertSecure Manager when the form opens.
- Hosts: Shown when the JKS Host Type is Linux. Add the Linux hosts to scan in the host table, individually or with the CSV Bulk Upload option, or select Automated Hosts Discovery to discover Linux hosts on AWS. At least one host is required unless Automated Hosts Discovery is selected. When the JKS Host Type is Windows, no host list is configured; the discovery agent reads the local drives and network shares directly.
What a path can be
Each entry in Store Paths can be a keystore file or a directory. Files and directories can be mixed in the same list, and a directory is searched for keystores in the folders beneath it. The accepted formats depend on the JKS Host Type:
- Windows host type: a drive-letter path, for example
C:\certs\app.jks, or a UNC share, for example\\server\share\keystores. - Linux host type: an absolute Linux path, for example
/opt/app/keystore.jks.
Up to 100 paths can be saved in one scan, and each path can be up to 4,096 characters long. Paths that repeat an earlier entry (the comparison ignores case) are removed when the scan is saved. A path in any other format is rejected with an Invalid Path message.
Default Linux paths
When the JKS Host Type is Linux, Store Paths is pre-filled with the following locations, which include the Java trust stores installed by common Linux distributions. Remove any path that is not required.
/opt/usr/lib/jvm/usr/java/etc/pki/java/srv/etc/pki/ca-trust/extracted/java/etc/ssl/certs/java
Which agent runs a JKS scan
A JKS scan can be run by any registered discovery agent, whatever store type the agent was installed for. The one restriction is the operating system of the agent: a scan whose paths are drive-letter paths or UNC shares can be opened only from Windows, so it must be run by a discovery agent installed on a Windows machine. A scan that connects to Linux hosts over SSH, or that uses Linux paths, runs on an agent on either operating system.
CertSecure Manager records the operating system of each discovery agent when the agent registers. If a Windows-path scan is started on an agent that is not on Windows, the scan is refused with a message that names the operating system of the agent. If the agent is on Windows but its operating system is reported as unknown, the agent was registered before it began reporting its operating system; re-register the agent.
Scan behavior
- A JKS scan is available only under Store discovery. The Container configuration type does not offer JKS.
- A UNC or drive-letter path cannot be combined with a list of SSH hosts or Automated Hosts Discovery, because a Windows path cannot be read over SSH. Such a configuration is rejected when it is saved.
- Every certificate in a keystore is collected, including the certificates in the chain of each key entry and the trusted certificate entries of a truststore. One keystore therefore produces many entries in the Discovery Inventory. See the Show JKS Store option on the Discovery Inventory page.
Cloud Discovery Configuration
All configured scan jobs are displayed in a centralized table, where users can view, edit, delete, or initiate scans. Scans can be triggered on-demand or scheduled for a later time, with the ability to assign them to any registered agent. This configuration workflow helps automate certificate discovery, making it easy to manage large-scale environments while ensuring no certificate is missed.