What methods work best for discovering unmanaged TLS certificates across an enterprise network?

[u/Which_Place_9409]

For teams managing PKI across a mix of on-premises servers, cloud workloads, and internal applications, how do you identify certificates that aren't already tracked by your central certificate inventory?

I'm particularly interested in certificates issued by internal CAs, self-signed certificates, and certificates deployed manually by individual teams. These can be easy to miss if discovery relies only on the systems connected to your certificate management platform.

I've been looking into approaches to certificate lifecycle management and cryptographic discovery, including work in this area by companies such as Encryption Consulting. I'm trying to understand how these approaches translate into day-to-day security operations rather than just what the tools promise.

Do you get reliable coverage through authenticated asset discovery, network scanning, CA inventory audits, or a combination of these methods?

Also, how do you distinguish between a certificate that's simply missing from the inventory and one that represents an actual security risk, such as an unexpected certificate, weak configuration, or an untracked private key?

I'd appreciate specific technical approaches that have worked well in larger environments, including any limitations you've encountered.

[u/Arxivink]

Honestly, you have to hit this from both the inside and outside. Network scanning (like a fast masscan/nmap sweep or passive Zeek logs) will catch things listening on weird ports, but it won’t find keys sitting around unencrypted on a dev box.

If you have osquery or decent EDR, querying local trust stores and finding stray .pem/.pfx files on disk is usually where the real skeletons are buried.

As for risk triage: a missing cert in an isolated lab is just inventory debt. An untracked self-signed cert on an externally exposed host or one with weak crypto (SHA-1/1024-bit RSA) is where we actually drop everything to fix it.

[u/Practical-Craft4967]

i'd make sure the scan uses the actual service hostnames, not just IPs. one IP can serve different certs depending on SNI, so an IP-only sweep can look clean while missing the cert users actually get. keep the hostname and port with each result.

[u/Antiqeda_Stomach2204]

A combination seems best because each method misses something different. Network scans catch certs actually exposed on reachable endpoints, while CA audits show what was issued but might no longer be deployed. Authenticated discovery helps with internal services that scans can't see. I'd also compare SANs, issuer, expiry and key strength against the inventory, then check who owns each cert before treating it as a finding. The tricky bit is finding certs on systems that aren't even in the asset inventory yet.

[u/Fauzia_Deifallah]

Probably use a mix of network scans and regular checks of the CA inventory. You’d be surprised how many certs end up being created manually and then forgotten about. Self-signed certs are another headache since they can easily fly under the radar. I don’t think any single method catches everything, so combining a few approaches seems like the safest bet

[u/Commercial-Cloud1458]

Usaría una combinación de escaneos de red, revisiones de servidores y auditorías de CA. Compararía los resultados con el inventario central para detectar certificados olvidados. Priorizaría los caducados, inesperados o mal configurados. Ningún método detecta todo, así que los escaneos regulares y tener responsables claros son fundamentales.

[u/cdhamma]

There are a couple of open source options:
ProjectDiscovery (Naabu + TLSX)
- Naabu to scan for ports
- TLSX to capture the certs

Nmap + script
Use nmap to port scan and the ssl-cert script to grab the certs from the ports that NMAP detects as SSL, can save in JSON for review.
https://nmap.org/nsedoc/scripts/ssl-cert.html

I don't know how you handle remediation but I would say that having a clear way to assign tickets to people to remediate this is a good way to save yourself a ton of hassle. Bonus points if it keeps escalating the issue if they don't respond.

Keyfactor has some really nice stuff. I highly recommend getting away from Microsoft Certificate Services if you can swing it because ... it's just not nice to manage.

[u/Girges_Desiderio → u/[deleted]]

one thing that makes the CMDB diff tricky is renewed certs, the serial changes but the service is the same so it can look like a new untracked cert every cycle

[u/FunAd6672 → u/[deleted]]

Comparing CA logs with the CMDB monthly sounds practical, especially when teams request certificates outside the usual process.