MICROSOFT CA pattern based discovery limit issue

[borkarvaish]

As we know, in ServiceNow Discovery, the Microsoft CA pattern has a default hard limit of 20,000 certificates per pattern execution. However, when I run the pattern with a reduced limit of 2,000 certificates, I still encounter a timeout error. From the logs, I can see that more than 1,900 certificates are being discovered, but they are not getting populated in the ServiceNow system. On the other hand, when I set the limit to 1,000 certificates, the discovery completes successfully and the certificates are visible in ServiceNow.

[Tanushree Maiti]

Hi @borkarvaish 

You are right.

Refer : KB2750889 Microsoft CA discovery failure with default 20,000 limit 

Resolution

Due to the large payload size, discovering certificates with the certutil command causes the pattern to fail due to a timeout.

Recommendation is to split the start_offset and limit parameters to fetch 3,000 to 5,000 certificates for each pattern execution. This may require Serverless Pattern Execution [discovery_ptrn_hostless_lchr] configurations.

For example: If 12,000 certificates need to be discovered, we will split discovery into four execution patterns with each returning 3,000 certificates. Open the discovery schedule: Make sure to create multiple Serverless Execution Pattern records, using the new button on the related list.

a) limit : 3000, ip XXXX, template_list : All, start_offset : 1
b) limit : 3000, ip XXXX template_list : All, start_offset : 3001
c) limit : 3000, ip XXXX, template_list : All, start_offset : 6001
d) limit : 3000, ip XXXX, template_list : All, start_offset : 9001 

By running the above discovery schedule, you would see each 4 pattern execution with 4 sets of inputs in Serverless Execution Pattern.

Add the execution as per the Certificate discovery requirements.