How to discover PKI certificates

Nisha30 · 3 weeks ago

Hello ITOM World,

There are couple of threads and document - Certificate management.

Unable to conclude are we able to discover certificates as out of box using Discovery ?? is there an OOB pattern / prove available?

OR

there has to be custom pattern to be created for this?

Thanks

Nisha30 · 3 weeks ago

Thanks @Renat Akhmedov

yes we do have CIM installed and ITOM.

So what I wanted to know is do we need to set up credentials something like what we do for infra device discovery .

We have our win, lin and other credentials set up as ITOm discovery.

Specific to Certificates what steps to be followed or the ITOM credentials for WIN,LIN etc will work and we do not need any configure/setup separately.

Thanks

View solution in original post

Renat Akhmedov · 3 weeks ago

Hi Nisha30,

You must have the Certificate Inventory and Management (CIM) module installed and configured + up-to-date ITOM Patterns,

If you have already checked it and it exists, verify that the MID Server has access to the targets and supports the required TLS versions/JRE settings,

Also, please don't forget to mark it helpful if it really helped you in some way,

Best regards,
Renat Akhmedov

Nisha30 · 3 weeks ago

Thanks @Renat Akhmedov

yes we do have CIM installed and ITOM.

So what I wanted to know is do we need to set up credentials something like what we do for infra device discovery .

We have our win, lin and other credentials set up as ITOm discovery.

Specific to Certificates what steps to be followed or the ITOM credentials for WIN,LIN etc will work and we do not need any configure/setup separately.

Thanks

Renat Akhmedov · 3 weeks ago

Hi Nisha30,

So, good question, short answer - no additional credentials are required for standard host-based discovery. Only CA integrations need their own credentials.

For keystore or Windows certificate store discovery, ITOM uses the existing Windows or SSH (Linux) credentials to log in and query the certificate locations.

For URL-based or Port/TLS certificate scans, no login credentials are required - the MID Server performs an outbound TLS connection to collect the certificate details.

For Certificate Authority integration, credentials are defined separately in the Certificate Authority Account record (API key or token) - not in Discovery credentials.

I hope it helps you,

Best regards,
Renat Akhmedov

Nisha30 · 2 weeks ago

Hello @Renat Akhmedov Thanks so for below as you mentioned ?

For Certificate Authority integration, credentials are defined separately in the Certificate Authority Account record (API key or token) - not in Discovery credentials.

What type of certificate they are ? Is it a separate integration ? or any document for same.