Skip to content

Certificate Monitoring

Most certificates reach the inventory because something saw them: a sensor's handshake, an active probe, a cloud provider's API, or a PEM you uploaded. Some you know about and cannot watch — a site no sensor can reach, a certificate on a partner's appliance, one that is due for renewal and of which you hold no copy.

Declare puts such a certificate into the inventory with as little as its common name and expiry date, so the platform warns you before it expires.

Declare a certificate

  1. Open Infrastructure → Cryptography → Certificates and choose Add certificate.
  2. Pick the Declare tab.
  3. Enter the Common name and the date it expires (Not after), then choose Add.

That is the whole minimum. Under More details you can also give:

Field Notes
Not before When it became valid. Must be earlier than the expiry date.
Issuer Free text, for example the name of the CA. Left empty when you do not know it.
Subject alternative names One per line.
Serial number If you give both an issuer and a serial number, they identify the certificate; otherwise the common name and expiry date do.
Ownership Internal or third party, the same as for an uploaded certificate.
Note Anything the next person should know, such as who renews it.
Where it is served A host, a port (443 unless you say otherwise) and an optional SNI name. With a host, Verify after adding is ticked: see Verifying where it is served.

A date that has already passed is allowed. The dialog asks Add as expired? before recording it, and the certificate is then shown as expired and raises an expiry alert.

The certificate appears in the Certificates lens at once with the source declared. Use the Source filter on the lens to list only the ones you declared.

Adding a certificate needs the manage assets permission. Editing or removing a declared certificate needs update assets.

Declaring the same certificate twice

A certificate is identified by its common name (not case sensitive) and its expiry date. Declaring the same pair again is refused with You already declared this certificate and a link to the one you already have. Declaring the same common name with a later expiry date is a different certificate — that is what a renewal looks like.

What alerts you get with only a name and a date

A declared certificate is treated like any other certificate with an expiry date:

  • Certificate expiring alerts in Remediation → Alerts open on the warning ladder for your organisation (60 days by default) and escalate as the date nears. They are resolved automatically when the certificate's date moves out beyond the ladder, or when you remove the certificate.
  • The usual expiry notifications go out at 30, 14 and 7 days and on the day it expires, and the certificate is marked expired once the date passes.
  • It counts in the Certs expiring tiles and the expiry charts on the dashboard.

Alerts start with the next scheduled scan, within 12 hours.

What you do not get is anything that needs the certificate itself. With only a name and a date there is no key, signature, trust verdict or post-quantum assessment, and the drawer says so: the Trust chip is empty, key and signature fields are blank, and there is no fingerprint — the platform does not show a fingerprint for a certificate it has not seen. To get those, upload the PEM (see Certificate chain management), or give the declaration a location and verify it where it is served: the platform then reads the certificate itself. An uploaded certificate is a separate entry. If it is the one served at your declared location, verifying links the declaration to it and you can merge the two; otherwise remove the declared entry once you have uploaded the real one.

Open, edit and remove

Click a declared certificate to open its drawer. Declared by you shows the place you said it is served and your note.

  • Edit changes any value you declared. Changing the expiry date or common name changes which certificate this is; if that collides with another one you declared, the change is refused and the other is named.
  • Once a certificate has been observed or uploaded, its values are measured and can no longer be edited; the drawer says so. What stays yours is where it is served and the note — see Editing where it is served.
  • Remove certificate deletes a declared certificate. It is offered only for certificates you declared. An observed certificate would return the next time something saw it, so it cannot be removed here.

Verifying where it is served

When you say where a certificate is served, the platform can check it there. Add and verify on the Declare tab does it as soon as the certificate is added (untick Verify after adding to skip it); Verify now in the drawer's Observation section does it again whenever you like. Verifying needs the update assets permission.

What happens

The platform makes one TLS connection to the host and port you gave, presents the SNI name (the host when it is a name, otherwise the common name), and reads the certificate the server sends. Nothing else on that host is contacted, no ports are scanned, and the host is not added to your inventory as an asset: the answer is recorded on the certificate.

The connection runs from the sensor that already sees that host's address, or else from one of your sensors whose networks cover it, or else from the platform sensor — the same choice an Active Scan makes. If the sensor that sees the host is offline, Verify now says so rather than trying from somewhere that may not reach it. A sensor too old to verify certificates is passed over for the platform sensor.

The drawer shows Verifying… while it runs and updates by itself, usually within a minute.

The three outcomes

Observation What it means
Observed (with the date) The certificate you declared is the one being served. If you had declared only a name and a date, the entry is upgraded in place with everything the served certificate says — issuer, key, signature, names, serial, the real expiry date and fingerprint — and from then on it is checked like any certificate the platform discovered: trust, key size, post-quantum readiness. Its values are now measured, so they can no longer be edited. If the platform already had that certificate as another entry, the declared one is linked to it instead, so the same certificate is never listed twice with one fingerprint.
Not observable (with the date and the reason) Nothing could be read there: the connection timed out or was refused, the name did not resolve, or what answered did not speak TLS. Everything you entered is kept and the expiry alerts keep running on it. The drawer says why, in plain words. The platform tries again every night.
Different certificate served The host presented a different certificate — often because it was renewed already. The certificate actually served is added as its own entry and linked from the drawer (Open the certificate served); the one you declared keeps alerting until you update, remove or merge it. The Certificate Hygiene framework's control CH-005 "Declared certificates match what is served" fails for it, so it shows in Risk & Compliance as well. A certificate for another name entirely counts as different too: a location typed by mistake never rewrites what you declared.

Unverified means nothing has checked the location yet. Use the Observation filter on the Certificates lens to list the declared certificates in each state.

Checked again every night

A location that could not be read today may be readable tomorrow — the firewall rule gets added, the host comes back, the renewal lands. So once a day the platform verifies again each declared certificate whose location is Unverified, Not observable or Different certificate served, in the same way Verify now does:

  • One check per certificate per day. A certificate checked, or being checked, in the last 24 hours is left alone, and a tenant with very many unreachable hosts has a bounded number checked each night (the longest-unchecked first).
  • From the sensor that last tried, while it is online and able to verify certificates; otherwise the platform picks one the way Verify now does.
  • It never asks about a host outside your networks. A host outside your registered networks is checked again only if someone already confirmed it (Verify it anyway? above) and it still resolves to the same addresses. Otherwise it is skipped until you press Verify now and confirm.
  • A certificate already Observed is not checked again by this; press Verify now whenever you want to.

Merge into the certificate served

Two outcomes leave your declaration linked to another entry in the inventory — the certificate actually served:

  • Observed, when the platform already had the served certificate as its own entry (found by a sensor, or uploaded), so the declaration could not be upgraded in place without listing one fingerprint twice.
  • Different certificate served, when you decide the served certificate is the real one — it was renewed.

In both, the drawer offers Merge into the certificate served. After you confirm, the platform moves your note, your ownership and where it is served onto the certificate served and removes the declared entry. Nothing already recorded on the served certificate is overwritten: if it has a note yours is added after it, and ownership and location are copied only when it has none. The location you moved reads Observed, since that is where the certificate was seen, and the certificate's history records what was merged.

Merging needs the update assets permission. It is offered only for a declaration that has not itself been observed (it carries no certificate of its own) and that a verification has linked to the certificate served; if the link is out of date, the drawer asks you to verify first. It cannot be undone — to keep both, leave them separate and remove the declaration when you no longer need it.

Editing where it is served after it was observed

When a verification upgrades your declaration in place, the certificate's values become measured and are locked. Where it is served and your note stay yours: Edit location in the drawer changes the host, port, SNI and note, and nothing else. Moving the host, the port or the SNI starts the question over: the observation goes back to Unverified, the consent for the old place is withdrawn and the last answer is cleared, so the next check (Verify now, or tonight's) is about the new place. Saving the same location again changes nothing. The same applies to a certificate a declaration was merged into.

Why only that host and port

Asking for a certificate to be verified is your consent to contact that one service. The platform records it the way it records an external connection you promoted to a monitored asset: the addresses the host resolved to, on that port, become a place your sensors may connect to — and nothing else on the host does. Changing or removing the location withdraws it.

Hosts outside your networks

If the host is outside the networks you have registered as yours, the platform asks first: This host is outside your registered networks. Verify it anyway? Confirming needs the discovery.create permission as well, and the check then runs from the platform sensor only. If your platform operator has turned off scanning hosts outside registered networks, the verification is not started and the drawer says so. On the Declare tab you can also choose Add without verifying.