Skip to content

Discover certificates on machines

Discovery finds the certificates already installed on the system that a machine connects to, and records each place a certificate is installed as an installation. Running it again shows which certificates were added or removed since the last run. Not every machine type supports discovery. The Discovery column of the machine types table in About machines shows which ones do.

You set a machine's discovery options when you create it, on the wizard's Discovery step, and you can change them later on the machine's Discovery tab. The options depend on the machine type, and each machine type's create page describes them. Without any options set, discovery searches everything it can reach, such as every partition, tenant, store, or resource type.

PFX and PKCS#12 keystore discovery

Password-protected PFX and PKCS#12 keystores require keystore credentials to be discovered. Citrix ADC (see Create a Citrix ADC machine) and Common KeyStore (see What discovery finds) machines support providing these credentials during discovery. For all other machine types, password-protected PFX and PKCS#12 files are skipped automatically, and the discovery job continues without failure.

Before you begin

  • A machine for a machine type that supports discovery. To create one, see About machines.
  • The machine's status is Verified. The status appears under the machine's name when you open the machine. If you start discovery through the API instead of the UI, the status can also be Unverified.

Perform discovery on a machine

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click the name of the machine.
  4. (Optional) To change what discovery looks for, click the Discovery tab and change the machine's discovery options.

  5. Click Discover Now.

    A message under the machine's name shows when discovery started. Refresh the page to see when it finishes. To stop discovery before it finishes, click Abort Discovery.

    Note

    Discovery keeps running when it runs into errors or certificate issues, but it stops after 20 errors. If discovery fails, review the event logs for details.

  6. Click the Discovery tab to see the results of the last run:

    • Total Discovered / Newly Discovered: the number of certificates found in this run, including those found in earlier runs, and the number that are new in this run.
    • Installations created: the number of installations that this run created.
    • Execution time: how long the run took.

  7. Click the Installations tab to see the discovered installations. Each installation's status is one of these:

    • Discovered: a certificate that didn't have an installation yet or wasn't provisioned by Certificate Manager - SaaS. An installation that Certificate Manager - SaaS provisioned changes from Installed to Discovered when discovery finds it.
    • Missing: an installation that the previous run found and this run didn't. It stays Missing for up to three days.
    • Validated: an installation that the previous run found and this run found again.

    Important

    If an installation stays Missing for more than three days, discovery deletes it.

Set up machine discovery schedule

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click the name of the machine.
  4. Click the Discovery tab.
  5. Enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).
  6. Click Save.

You can also set the discovery schedule when you create a machine, on the wizard's Discovery step.