Skip to content

Internal certificate scanners

For certificates on hosts inside an organization's network that CertIntel can't reach itself. A script running inside that network reports each result inward with a write-scoped key scoped to internal_certs. Everything POSTs to one endpoint:

POST /api/v1/internal-certs
X-Api-Key: cik_<prefix>.<secret>
Content-Type: application/json; charset=utf-8

Returns 201. Rows are upserted server-side (not appended).

Reported certificates land in the unified inventory at Certificates › source: Internal scan; each certificate's detail dialog lists every scanner that has seen it.

Fields

Field Type Notes
source_method enum https (live probe) or local_store (certificate store read)
thumbprint string required
target_host, target_port string / integer for https scans
store_path string for local_store scans, e.g. Cert:\LocalMachine\My
subject_cn, issuer_cn string optional
not_before, not_after string (ISO-8601) optional
friendly_name, owner, notes string optional technician guidance
run_as string optional; the Windows identity that ran the scan
computer_name string the reporting machine

The upsert identity is target_host:target_port | thumbprint for an https scan and store_path | thumbprint for a local_store scan, combined with the reporting key - so re-running the same scan updates its rows while a second scanning device stays distinct.

Scan-InternalCerts.ps1 - live TLS probe

Probes a list of internal hostname:port targets for whatever certificate they serve. No trust, hostname or expiry validation is performed - that is the point; this is a monitor, not a client. A single unreachable target logs a warning and is skipped; the script exits non-zero only if every target failed. Edit the $Targets array at the top of the file.

Scan-LocalCertStore.ps1 - local certificate store

Run on a specific machine, this reports every certificate in that machine's own Windows certificate store - the one case the live probe can't cover: a certificate installed but never served on any port, such as an internal root or subordinate CA on your CA server. Edit $StoreSelections to pick stores and (optionally) restrict to exact subject common names. Defaults to LocalMachine\My and LocalMachine\CA; Root is present but commented out.

Download the scripts

Warning

These are example scripts. Review them and test in a non-production environment before relying on them.

Both read CERTINTEL_INTERNAL_CERTS_URL and CERTINTEL_API_KEY from the environment, falling back to values you edit at the top of the file. Set them as a scheduled task, e.g. daily.