📦 Certificate Inventory
Certificate Inventory allows you to view, manage, and organize all your certificates from a central location.
Overview
Certificate Inventory features:
- 📋 Centralized certificate catalog
- 🔍 Advanced search and filtering
- 🏷️ Tagging and grouping
- 📊 Detailed certificate information
- 📈 Visualization and reporting
Certificate Inventory Sources
Certificate Inventory collects and manages certificates from different sources in one central location. Your system automatically performs certificate discovery from the following sources:
📡 Network Scanning
Certificates discovered through automatic scanning in your infrastructure:
- TLS/SSL certificates accessible via open ports
- Web servers, API gateways, load balancers
- Regular scans on specified IP ranges or domains
- Automatic discovery on specific port ranges (443, 8443, etc.)
🌐 Certificate Transparency Logs Scanning (CT Logs)
Certificates discovered from public certificate logs:
- CT log scanning for domains belonging to your organization
- Detection of incorrectly or unauthorized issued certificates
- Monitoring all certificates issued by public CAs
✍️ Certificates Signed Through Application
Certificates created and signed on the platform:
- Certificates created with Certificate Signing Request (CSR)
- Certificates signed through integrated CAs
- Self-signed certificates
- Internal CA certificates
📥 Imported Certificates
Certificates manually added to the system:
- Certificates uploaded in PEM, DER, PFX/P12 formats
- Certificate chains transferred from external systems
- Certificates obtained from third-party CAs
🔗 Discovered from Integration Systems
Certificates automatically discovered through integrated systems:
- F5 BIG-IP • Citrix NetScaler • FortiWeb • FortiGate • FortiManager
- NGINX / NGINX Plus • Palo Alto Networks • PaloAlto Panorama
- Apache • IIS • Apache Tomcat
- Windows TrustStore • Java Keystore (JKS)
- IBM DataPower • HashiCorp Vault
Visit the Integrations page to add a new integration and follow step-by-step installation instructions.
Discovered Certificates List
This is a detailed list of all certificates found in your infrastructure as a result of Certificate Discovery operations. This list is updated after each discovery, and new certificates are automatically added.
Key Features
The Discovered Certificates list offers powerful features that simplify certificate management:
| Feature | Description |
|---|---|
| 🔍 Detailed Filtering | Ability to search separately for each column |
| 📊 Customizable View | Select the columns you want to see |
| 📈 Bulk Operations | Perform the same operation on multiple certificates simultaneously |
| 📤 Export | Export selected certificates in different formats |
| ⚡ Quick Access | Instant access to critical information like last seen time, port, type |
Advanced Search and Filtering
You can search certificates by a wide range of criteria. Every column in the table can be searched and filtered individually; even if the table contains hundreds of columns, you can search across all displayed columns. This lets you find certificates by Issuing CA, Common Name (CN), Subject Alternative Name (SAN), algorithm, key size, expiration date, issuance date, and so on.
In addition, you can use inequality operators on numeric and date fields, and wildcards on text fields.
Inequality Operators
For numeric and date fields (key size, expiration date, issuance date), you can use inequality operators to perform range searches:
| Operator | Meaning | Example |
|---|---|---|
< | Less than | expires:<2025-01-01 |
<= | Less than or equal to | keysize:<=2048 |
>= | Greater than or equal to | keysize:>=4096 |
!= | Not equal to | algorithm:!=RSA |
# Certificates expiring before the given date
expires:<2025-01-01
# Certificates with weak keys (2048 bit and below)
keysize:<=2048
# Non-RSA certificates (e.g. ECDSA)
algorithm:!=RSA
# Certificates issued after a specific date
issued:>=2024-01-01
Searching with Wildcards
Text fields support the * (multiple characters) and ? (single character) wildcards:
# All subdomains of example.com
cn:*.example.com
# All servers starting with "web"
cn:web*
# All certificates whose SAN contains "api"
san:*api*
Provided Information
In the certificate inventory, basic information for each certificate is presented in list view. When you click on a certificate, you can access all the details of the certificate.
Information Displayed in List View
| Information | Description |
|---|---|
| Last Seen | When the certificate was last seen |
| Server | Server address where the certificate is located |
| Port | Port number on which the certificate is running |
| Type | Discovery method (Network Scanning, CT Logs, Import, Integration, Manual) |
| Subject | Certificate owner information (CN, OU, O) |
| Not Before | Certificate validity start date |
| Not After | Certificate validity end date |
Detailed View
SecTrail CM parses certificates and stores all information. In detailed view, you can access all fields in the X.509 standard (Subject, Issuer, Serial Number, Public Key, Extensions, Fingerprint, Certificate Chain, etc.) along with discovery source, related systems, and usage history.
Bulk Operation Capabilities
Bulk operations that can be performed from the list:
- ✅ Change Status - Bulk update status of selected certificates
- 📤 Export - Export selected certificates (CSV, Excel, PDF)
- 🗑️ Delete - Clean up certificates no longer in use
- 📋 Create Signing Request - Generate signing request (CSR) for renewal
Get Started
- 📖 User Guide: Inventory - CA integration and configuration steps