🔍 Certificate Discovery
Certificate Discovery is a powerful feature of SecTrail CM that automatically finds all SSL/TLS certificates in your infrastructure and adds them to inventory.
Overview
Not knowing where certificates are used in organizations poses a major security risk. Expired or forgotten certificates can lead to service interruptions and security vulnerabilities.
Key Features
SecTrail CM's Certificate Discovery feature simplifies certificate management:
| Feature | Description |
|---|---|
| 🔍 Automatic Discovery | Automatically finds all certificates in your infrastructure |
| 📊 Centralized Inventory | Collects all certificates in a single centralized system |
| 🔄 Regular Scanning | Keeps inventory up-to-date with scheduled scans |
| ⚡ Fast Scanning | Scans large networks quickly and efficiently |
| 🌐 Multiple Methods | Comprehensive discovery with network scanning and CT Logs |
Discovery Methods
SecTrail CM offers two powerful discovery methods suitable for different scenarios:
1. Network Scanning
Network Scanning detects SSL/TLS certificates on devices in the network by scanning specified IP ranges or subnets.
How Does it Work?
The Network Scanning method detects active SSL/TLS connections by scanning IP ranges and ports you specify. Each certificate found is automatically added to inventory, and the scan is repeated at configured intervals to discover new certificates.
Use Cases
The Network Scanning method is used in the following scenarios:
- 🏢 Server Infrastructure - Regularly scan your entire server infrastructure
- 🗄️ Datacenter Scanning - Scan a specific datacenter or subnet
- 🆕 New Servers - Automatically discover newly added servers
- 🔐 Port-based Scanning - Find services running on non-standard ports
2. Certificate Transparency Logs (CT Logs)
Certificate Transparency Logs are records of publicly issued certificates. Certificate Authorities (CAs) register the certificates they issue in these logs. This method is used for domain-based certificate discovery.
How Does it Work?
The Certificate Transparency Logs method scans public certificate authority (CA) records for the domain you specify. This way, you can discover all public certificates belonging to your organization that you may not be aware of. SecTrail CM uses trusted CT Log services like crt.sh and SSLMate.
Advantages
| Advantage | Description |
|---|---|
| 🌐 Public Certificates | Finds all publicly issued certificates |
| 🔍 Unknown Certificates | Discovers certificates belonging to your organization that you didn't know about |
| 👥 Shadow IT | Detects certificates obtained by unauthorized departments |
| 🏷️ Subdomain Discovery | Finds all subdomain certificates linked to the main domain |
Use Cases
The Certificate Transparency Logs method is used in the following scenarios:
- 🌐 Public Certificates - Discover all your internet-facing certificates
- 🏢 Organization Inventory - Scan all domains belonging to the organization
- 👤 Shadow IT Detection - Find unauthorized certificates
- 🔐 Subdomain Monitoring - Track all subdomain certificates
3. Discovery from Integration Systems
Integration Discovery automatically discovers certificates in these systems by directly integrating with existing systems in your infrastructure (load balancer, web server, keystore, etc.). It provides real-time certificate inventory through API or protocol-based connections.
How Does it Work?
SecTrail CM automatically discovers all certificates in integrated systems by establishing secure API or protocol connections. After configuring integration, the system automatically scans at specified intervals and adds newly added or updated certificates to inventory.
Supported Integration Systems
SecTrail CM can perform automatic certificate discovery from the following systems:
- F5 BIG-IP • Citrix NetScaler • FortiWeb
- NGINX / NGINX Plus • Palo Alto Networks
- Apache • IIS • Apache Tomcat
- Windows TrustStore • Java Keystore (JKS)
- IBM DataPower • HashiCorp Vault
Use Cases
Integration Discovery is used in the following scenarios:
- 🔧 Configuration Management - Centrally manage certificates on load balancers and web servers
- 🔑 Keystore Monitoring - Track certificates in Java Keystore and Windows TrustStore
- 🔄 Automatic Synchronization - Instantly capture changes in production systems
- 📦 Secret Management - Discover certificates in secret management systems like HashiCorp Vault
Visit the Integrations page to set up integrations with supported systems.
Recommended Approaches
| Recommendation | Description |
|---|---|
| ⏰ Regular Scanning | Quickly capture new certificates by performing daily automatic scans |
| 🧪 Test Environment | Test in a test environment before moving to production |
| ⏱️ Proper Scheduling | Run scans outside business hours (at night) |
Considerations
| Topic | Description |
|---|---|
| 🚦 Network Load | Avoid large network scans during peak hours |
| 📈 Traffic Monitoring | Monitor network traffic during scanning |
| 🛡️ Firewall Rules | Ensure the ports SecTrail CM will scan are open |
| ⏲️ Rate Limiting | Don't open too many connections simultaneously, pay attention to rate limiting |
| 🔐 Permissions | Obtain necessary permissions for networks you will scan |
Discovery Operations
SecTrail CM offers both scheduled automatic discovery and instant manual discovery:
Automatic Discovery (Scheduled)
You can create discovery tasks that run automatically at specified intervals (daily or weekly). This way, new certificates in your infrastructure are continuously discovered and your inventory stays up-to-date.
Manual Discovery (Instant)
You can perform one-time quick scans without creating scheduled tasks. Useful when you add a new server or need urgent verification.
Get Started
- 📖 User Guide: Discovery - CA integration and configuration steps