Skip to content

Agent monitors and internal endpoints

The agent inventories certificates from five bounded source types:

  1. locally configured TLS probes (host and port);
  2. locally configured certificate files;
  3. locally configured Windows certificate stores;
  4. CRL distribution points - registered on the platform's CRL Distribution Points page or configured locally (crl_monitors: id, source, notes, enabled), read on the scan schedule and reported as CRL Distribution Point - Agent (Agent 1.3.73+; revoked entries since 1.3.80). See CRL monitoring; and
  5. internal endpoints assigned through CertIntel's platform lease API.

Open Agent Monitors to manage local sources. Platform assignments are managed in CertIntel and appear separately under Cloud-assigned monitor results on the agent Overview; they are not copied into local monitor configuration.

In CertIntel, open Internal Endpoints (the page is titled Internal TLS Probe - Cloud) and expand Add an internal endpoint. Enter its hostname or IP, port (default 443), an optional Label, the Organization, and Check every (hours) (1–720, default 24). Use Recheck to request an earlier check, Pause to stop scheduling it, and Resume to continue. The page shows last/next check times and Pending (never checked), OK, Failed, Checking, Paused, or Skipped by certificate policy status. A failed check is retried after one hour (or the interval, if shorter) rather than waiting for the full interval.

Local TLS probes

Choose Add TLS probe… and enter an FQDN or IP address, port, optional notes and enabled state. The agent makes a TLS connection and inventories the leaf certificate served at that endpoint. It does no subnet scan, port sweep or network service discovery.

Agent 1.5.0 and later can also read the web and service configuration of the machine itself to pre-fill a new workflow (Server detection). That is local and read-only, does not probe the network, and its results are not sent to CertIntel or added to the inventory.

The observation deliberately accepts expired, self-signed, untrusted and name-mismatched certificates. The purpose is inventory, not application trust validation. Connections use TLS 1.2 or newer and a bounded timeout. Normal HTTPS validation remains enabled for the agent's own CertIntel, ACME and release traffic. Agent probes are not graded: the TLS grade covers sites CertIntel monitors from the platform only.

An unreachable endpoint records an observation error and does not prevent other configured sources from being checked.

On Windows, adding or changing a probe's host or port is a security-sensitive change: the app asks for administrator approval and lists the target (Add TLS monitor … targeting host:port) before saving. Editing notes or the Enabled box does not need the second confirmation.

Platform-assigned endpoints

Platform-assigned checks are on by default for an agent first installed on 1.3.79 or later, so a registered or enrolled agent polls for assigned endpoints without a separate approval. An upgrade keeps the saved setting: installations that already had a configuration are unchanged, and a version 1 configuration (1.3.54 or earlier) is still migrated with the setting off. The switch is Check internal endpoints assigned by CertIntel on the agent Overview (Windows) or m on the Agent Monitors screen of the Linux terminal interface. Turning it on later is a security-sensitive change that asks for administrator approval on Windows.

When enabled, the connected agent asks CertIntel for internal endpoints currently due for this machine on its own schedule (Settings → Schedules → Check interval (minutes, 5–1440), default 60), independently of the local scan interval. That interval only sets how often the agent asks; CertIntel decides how often each endpoint is probed and hands out a short lease. The agent probes it and returns either certificate metadata or the scan error before the lease expires. A lease with less than 15 seconds left is reported as failed without probing (The scan lease expired before this agent could start the check; verify the agent and platform clocks.).

This allows endpoint ownership and scheduling to stay in CertIntel while the TLS connection originates from inside the network. If an assignment is being handled by another agent or is not due, it is not returned. A locally stale copy of a platform observation therefore does not by itself raise an agent attention flag; the platform remains authoritative for lease freshness.

Authentication failure stops platform-assigned work for that scan. Other platform errors are recorded while locally configured monitors continue.

Scan schedule and manual scans

The normal scan interval is 24 hours and can be set from 1 to 720 hours under Settings → Schedules → Scan interval (hours, 1–720). Scans are serialized so an interval tick or manual request cannot start overlapping work. This interval controls locally configured TLS, file, and store monitors. A manual Scan and Report includes those monitors and due platform assignments; Scan now on the Schedules row does the same, and Check now next to the internal-endpoint row asks CertIntel for due assignments immediately.

Choose Scan and Report at the top of the app to queue an immediate scan. The activity dialog tracks that job and starts at the top of the log. New activity preserves the reading position unless Follow latest activity is enabled. Results also appear in Agent Monitors → Latest discovery results and on Jobs.

CLI equivalents:

certintel certificates discover
certintel certificates inventory --json
certintel jobs get JOB-ID --json

The first command returns a queued job rather than waiting for every network probe and report to finish.

Post-install re-check

After the agent installs a managed certificate, it re-probes any enabled local TLS probe whose host is one of the new certificate's names (configured domains or SANs, including one-label wildcards) and reports the result, so the inventory shows the new thumbprint right away. The activity entry post-install-recheck lists each endpoint as serving the new certificate, still serving a different certificate or no certificate observed. The re-check is observation only and never changes the deployment.

Platform-assigned endpoints the agent has probed before are re-checked the same way when the platform offers on-demand re-checks; otherwise the agent records post-install-recheck-skipped and those endpoints refresh on their regular schedule. Turn the behaviour off with After installing a managed certificate, re-check monitored TLS endpoints it covers under Settings → Schedules (Windows) or c on the Linux Agent Monitors screen.

For endpoints on the Public Endpoints page, CertIntel also compares what each endpoint serves with the latest renewal and alerts when it still serves an old certificate; see Served versus issued. That check does not cover the internal endpoints described on this page yet.

What is reported

Successful observations submit public certificate metadata such as subject, SANs, issuer, thumbprint, validity dates, source/location, hostname/port and configured notes, plus the presented certificate chain (up to ten certificates) so the dashboard can build and validate certification paths. Private keys, keystore passwords and local API credentials are never included.

The chain is sent exactly as captured whenever it is well formed (the leaf matches the first member, at most ten members, each parseable). Agents 1.3.71 and later submit it regardless of the ignore list: the list only decides which CA certificates the agent reports as inventory of their own. Earlier agents withheld the whole chain whenever any member was ignored, which, because every public CA is on the list, left most publicly issued certificates without a chain; the certificate detail shows the agent's chain evidence line (captured versus submitted members and the reason) when a chain was withheld.

Reports are kept in a bounded persistent queue (up to 1,000 reports or 4 MiB) when CertIntel is temporarily unavailable and retried with backoff. A platform authentication error requires credential/approval investigation. Use Test connection, Activity, and certintel diagnostics to distinguish a local scan failure from a reporting failure.

See Certificate stores and files for Windows store filters, notes, supported file formats and protected PKCS#12/JKS passwords.

For a non-Windows host that is not running this agent, the standalone reporting scripts remain available under Internal certificate scanners.