Skip to content

How it works

CertIntel doesn't run one kind of check - it pulls certificate data in from four different directions and puts it in one inventory.

CertIntel certificate inventory & monitoring Public site e.g. www.example.com Client firewall nothing inside is reachable from outside it Certificate Authority (ACME) Linux Agent TLS probes Other device no agent installed Windows Agent TLS probes + cert store checks cert checks cert reports certs reports certs & renewals polls & reads TLS cert ① request ④ issues ② publish TXT record ③ CA checks DNS TXT (hosted here)
CertIntel pulls certificate data from four directions: a direct poll of a public site, agents behind a client firewall, those same agents checking a device with no agent of its own, and the ACME/DNS-01 renewal loop - where CertIntel hosts the TXT record the CA checks.

The four paths

Public endpoints. For anything with a public hostname, CertIntel just connects to it - no software to install. Add the hostname on the Public Endpoints page and CertIntel polls it on a timer, reading whatever certificate the server presents. See Public site monitor.

The Agent (Windows and Linux). Install the Agent on a host and it reports what it finds there: TLS probes against internal endpoints you assign it - including hosts that can't run an agent themselves, like the "Other device" in the diagram above - and, on Windows, a scan of the local certificate stores and files. On Windows the Agent can also own certificate issuance and renewal outright, with its own built-in ACME client. See Windows Agent - install & setup and Monitors & internal endpoints.

Anything else. Not every device can run an agent - an appliance, a load balancer, an internal CA. Those never need to be reachable from outside your network; an Agent already behind your firewall probes them the same way it probes any other internal endpoint, and reports what it finds. For anything an Agent can't reach either, a small reporting script (or a one-off API call) submits certificate data to CertIntel directly. See Internal certificate scanners.

ACME renewals. Whatever's actually running the ACME client - the Windows Agent, simple-acme, Certbot, Posh-ACME - the shape of a renewal is always the same: order a certificate from the CA, prove you control the domain, get the certificate issued and installed, then tell CertIntel it happened. The domain proof is usually a DNS TXT record (DNS-01), and CertIntel can host that record for you - see Delegated DNS-01 - so the ACME client publishes the challenge straight to CertIntel instead of needing its own DNS provider credentials. Full request/response detail is in ACME check-ins & renewals.

Whichever path a certificate comes in through, it lands in the same place: see Certificates for the unified inventory.