Monitoring certificate stores and files¶

The Agent Monitors page can inventory certificates that are installed on disk but are not necessarily served from a network port. Store and file monitoring is read-only: it extracts public certificate metadata and never exports a private key.

Windows certificate stores¶

Choose Add store… and configure:

• Location — Local computer (certlm.msc) or Service account's Current User store;
• Store name — select a discovered store or type another valid store name;
• Names — optional comma-separated CN/DNS SAN filters;
• Notes — optional ordered pattern=note mappings; and
• Enabled — whether scheduled and manual scans include the store.

Current User means the CertIntel service account (normally LocalSystem), not the administrator who opened the desktop app.

Name filters are case-insensitive and match the subject common name or a DNS SAN. Each * consumes one or more characters within one DNS label; it does not cross a dot. Leave Names empty to inventory the whole store. The first matching Notes rule adds its note to the reported observation.

Store enumeration is bounded to 4,096 certificates and at most 1,000 selected observations per configured store. Adding or changing a store's location, name or filters asks for administrator approval.

AD CS templates¶

To watch certificates issued from an AD CS template, use Configure AD CS Template - Agent… rather than the store dialog. It requires a template (internal name or dotted OID) and scans the chosen local store for certificates carrying that template. Checkbox changes in that dialog stay in the draft until Apply; Cancel discards them.

The Windows Agent also fetches all pages of the organization's active AD CS template assignments from CertIntel and scans LocalMachine\My. Those results appear under Cloud-assigned monitor results on Overview and refresh on the scan schedule. Name matching is case-insensitive; dotted template OIDs are normalized and matched exactly. Paused assignments are skipped. No matching certificate is a successful empty result, not a missing-certificate error. Linux skips this Windows-only scan, and older servers returning 404 for template assignments are handled quietly.

Matches are reported as source_method=local_store, discovery_kind=adcs_template, with the configured template_name and public certificate facts. See AD CS template monitoring.

Common stores¶

Every store is a valid monitoring source. Only My (Personal) and WebHosting are accepted as certificate deployment destinations; trust stores, Remote Desktop, TrustedPeople and custom stores are refused.

Certificate files¶

Choose Add file… and browse to one absolute file path, or type a wildcard pattern such as /etc/certintel/certs/*/*-chain.pem or C:\certs\*\*.pfx. Add notes and an enabled state just like the other monitors.

Supported files:

Files must be regular files and are limited to 4 MiB. The agent verifies that the same file remains open during the bounded read. It does not follow a configured directory or discover sibling files unless the path is a pattern.

In a pattern, * matches any run of characters within one folder level and ? matches one character; neither crosses a folder separator, so /etc/certintel/certs/*/*-chain.pem reads the chain file in each certificate folder but not files nested deeper. The pattern keeps the extension rules above (*.pem, not *.p*), and every matching file is read under the single-file rules: regular files only, no symbolic links, the monitor's password, keytool and alias applied to each match, at most 1000 matches. A scan lists the pattern once with the number of certificates found. A match that cannot be read is reported by its path, and a pattern that matches no file is reported as an error rather than as an empty result.

PKCS#12 and JKS passwords are sent to the service through the local protected API, encrypted at rest, and never displayed again. When editing, leave the password blank to keep the existing value. JKS requires an absolute keytool path and an alias. keytool receives the password through an environment variable rather than a command-line argument; PKCS#12 archives are decoded in a bounded helper process. On Linux, set or replace the password with sudo certintel secret set file-monitor MONITOR-ID or the s key in the terminal interface.

Removing a password-protected file monitor (.pfx, .p12, .jks), or changing it to a different file type, permanently deletes its stored password. On Windows this is one of the changes that shows the administrator approval dialog before it is saved.

Monitoring a JKS starts a Java process and may use more CPU than reading a public certificate file. Other configured scans are normally lightweight.

Run and inspect a scan¶

Choose Scan and Report at the top of the desktop app. The resulting job shows the activity for that scan, while Latest discovery results shows the last local observations.

certintel certificates discover
certintel certificates inventory --json

Reported data includes certificate subject/SANs, issuer, thumbprint, validity, source/location, configured notes and machine identity. Private keys and archive passwords are not reported.

Store monitoring versus deployment¶

Monitoring reads whatever already exists. A certificate workflow's Windows certificate store destination performs a privileged installation into the Local Computer My or WebHosting store, can keep the private key non-exportable, and can grant selected principals private-key read access. See Certificate workflows and deployment for that separate operation. After a renewal the standard store/IIS workflows evaluate the previous certificate and remove it only when cleanup is turned on and no inspectable consumer still uses it; a scheduled purge can remove superseded certificates later. See Windows store verification. Adding a store monitor never removes anything.