How it works¶

CertIntel pulls certificate data in from public probes, Agents, reporting scripts, and ACME renewals, then unifies observed certificates in one inventory. Certificate Transparency findings are tracked separately.

TLS probes and reporting¶

CertIntel probes public endpoints itself. An Agent inside your network probes what only that network can reach - its own server, appliances that can't run an agent, the firewall's own portal, and public sites as your network sees them - and reports everything to CertIntel over outbound HTTPS.

Click to enlarge. Blue solid lines are TLS probes, which read the certificate an endpoint serves. Red dashed lines are Agent reports to CertIntel.

Obtaining a public TLS certificate¶

The Agent orders the certificate, proves domain control through CertIntel's Delegated DNS-01 service, and installs the result. It never needs credentials for your real DNS zone.

Click to enlarge. The numbers follow one issuance or renewal.

The four paths¶

Public endpoints. For anything with a public hostname, CertIntel just connects to it - no software to install. Add the hostname on the Public Endpoints page and CertIntel polls it on a timer, reading whatever certificate the server presents, and on a platform build that offers it also grades the endpoint's TLS configuration from A to F (see TLS grade). Manage these checks in the platform. For API integration details, use /api/v1/docs on your CertIntel deployment.

The Agent (Windows and Linux). Install the Agent on a host and it reports what it finds there: TLS probes against internal endpoints you assign it - including services that can't run an agent themselves, like the vendor appliance in the probes diagram - and scans of configured certificate files. Windows also supports local certificate stores. Both Windows and Linux can own certificate issuance and renewal using the built-in ACME client; the diagram shows one Windows example. See Windows Agent - install & setup, Linux Agent - install & setup, and Monitors & internal endpoints.

Anything else. Not every device can run an agent - an appliance, a load balancer, an internal CA. Those never need to be reachable from outside your network; an Agent already behind your firewall probes them the same way it probes any other internal endpoint, and reports what it finds. For F5 BIG-IP, FortiGate, PAN-OS, NetScaler ADC and SonicWall appliances, an Agent 1.5.0 or later can also deploy renewed certificates over the device's management API (see Remote & appliance deployment). For anything an Agent can't reach either, a small reporting script (or a one-off API call) submits certificate data to CertIntel directly. See Internal certificate scanners.

ACME renewals. Whatever's actually running the ACME client - the Windows or Linux Agent, simple-acme, Certbot, Posh-ACME - the shape of a renewal is always the same: order a certificate from the CA, prove you control the domain, get the certificate issued and installed, then tell CertIntel it happened. The domain proof is usually a DNS TXT record (DNS-01), and CertIntel can host that record for you - see Delegated DNS-01 - so the ACME client publishes the challenge straight to CertIntel instead of needing its own DNS provider credentials. Full request/response detail is in ACME check-ins & renewals.

Whichever path a certificate comes in through, it lands in the same place: see Certificates for the unified inventory.