How to create a Schedule for Microsoft CA Certificate Authority or how to discover certs Microsoft CA Certificate more than 20k or how to discover large number of Microsoft CA Certificate? ?

[thiyagu_j]

How to create a schedule for Microsoft CA Certificate Discovery?

 Solution:

Step1: Goto Discovery Schedule, Click on New button.

Step2: Fill the Form Fields:

            Name:  Give an appropriate name for the schedule.

            Discover: Select Serverless as the discover type.

            Mid: select an appropriate mid for the discovery.

Once all these above fields are done, save the discovery schedule.

Step3: After saving the schedule, two tabs got added below

           1.Discovery Status

            2.Serverless Execution pattern.

Step4: Select Serverless Execution Pattern and Click New button.

Step5: Give name and select Microsoft CA pattern in the form fields and save the form.

Step6: After saving, fill the input parameter for the pattern.

           1.template_list : Fill template for the certificate discovery 

           2.start_offset: By default, it will discover the certificate from the 1st index. If not filled, it will take it as index as 1.

           3.ip: IP of the machine where certs are deployed.

Note: By default 20k certs will discover. 

 Step7: If there are more than 20k certs got deployed, here is the way to add a serverless pattern to the created schedule.

            1.Goto Created the discovery schedule and select the serverless Execution pattern tab.

            2. Continue step 4, 5 and in 6th step start offset is from 20001.

So continue 4,5 and 6 with the increase of 20k for start offset until, all the certs got covered.

Step8: After completing all the steps, click the discover now link from the schedule. Discovery will bring all the certs.

Thanks,

Thiyagu

[abhishek113]

Hi Thiyaju,

Getting while running Certificate Discovery.Please help here.

Getting below error while running Discovery Schedule-Certificate Discovery

Identification sections in pattern failed: section: MS CA ID, error: JAVASCRIPT_CODE_FAILURE: Caused by error in Ad hoc script 'EvalClosure-Run certutil command per template/All' at line 13\n\n 10: \t\t\t\t\t\t\t\tif (templateArry.equals('All'))\n

[thiyagu_j]

Can you please give me the screenshot of discovery schedule which you have created?

[thiyagu_j]

Can you please share the discovery schedule created screenshot and added pattern screenshot for the schedule?

[abhishek113]

[Andrzej Krawcz1]

Hi Abhishek,

check if you have correct credentials to the machine.
You can see that in pattern logs

[shivareddy]

Hi Abhishek

I have followed the same process for discovery of certificates from microsoft certificate authority, But i am facing with error

Error: Identification Engine: Discovery status is FAILURE, Required attribute fingerprint is missing for CI Type cmdb_ci_certificate

Could you please help on this 

[shivareddy]

Hi Andrzej 

I am getting the same error as you have shared above in a screen shot, so where(discovery_credentials) and which types of credentials(it windows or any other) we need to set up for this configuration

Thanks 
Shiva Reddy

[thiyagu_j]

hi Shivareddy,

    This issue is due to no certificates are discovered during discovery. If you need help please create CASE TASK so that You will get assistance.

Thanks,

Thiyagu

[BhupeshG]

Hi Thiyagu

We are getting issue like even though I have increased the disco max log size property to 100000

Result is larger than 1000 characters and was truncated by the logger

Can you please advise

[BhupeshG]

can we even reduce the pagination like 0-5000 and then 5000 -10000

my CA is discoverying is less then 20k but the payload returned in of 30 MB

and ServiceNow thrown an exception and unable to process

[thiyagu_j]

yes we can do it....

[BhupeshG]

How. Can you please advise.

What setting we need to change 

[Adam Peterson]

I am trying to get this setup but having a difficult time. This tells me to select Serverless in the Discover field but the Docs tell me to select Certificates. I've tried both but still coming up with errors. Do you guys put in Credentials anywhere for this integration? Thanks!

[BhupeshG]

this is serverless only. 

It uses windows credentials just like any other discovery. Check the discovery log and accordingly take an action.

[The SN Nerd]

I had to add the server as a proxy host as per this work instruction

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1096137

This is missing from all the documentation...

[jay_rp]

we got close to 75K certs in the CA. Every time I run the discovery , its pulling 2500 to 2800 unique certs but not all at once . Is there a specific reason . I am using 6 different patterns with 20K on limit on each as mentioned above 

[thiyagu_j]

This may due to root and intermediate certs are same....

[thiyagu_j]

and also check the status of the certificate.

[thiyagu_j]

Please check this Article: https://www.servicenow.com/community/itom-articles/certificate-list-count-mis-matches-during-certifi...

[jay_rp]

Thanks for your assistance @thiyagu_j  . I verified our CA server and validated that we got close 22K certificates in issued state . The request Id for the issued certs starts from 40010 to 62350. I created two serverless execution patterns . One from 40K to 60K and another from 60001 to 70000 as my request ID's would get discovered within this range. Both the patterns has proxy host defined with startoffset , templatelist and IP address as the parameters . 

On execution both the pattern logs are very different . The 60K pattern is atleast attempting to scan through the request ID's from 60001 as specified but the 40K pattern is different altogether . i have attached the screenshot of the pattern logs here and my executions just discovered 2700 certs out of the 20K certs that existed . Any inputs here would be great 

60K Pattern log 

40K pattern log

[Madhan Nagolu]

Hi Thiyagu,

I did similar to your setup but we are getting "Certificate table is empty , Pattern name: MicroSoft CA - Certificate Management, To Check Pattern Log Press Here "

Error message from Mid server log :

2023-09-20T14:45:25.759-0500 WARN (ExecutorThread:Worker-Standard:HorizontalDiscoveryProbe-6bff49df97953d502146bcbe2153af9a) [RemotePowerShellSession:400] Hostname null does not resolve to original IP
2023-09-20T14:45:25.852-0500 ERROR (Worker-Standard:HorizontalDiscoveryProbe-6bff49df97953d502146bcbe2153af9a) [APowerShellProvider:303] (112)APowerShellProvider - Error during execution of Windows command: executeCommand -Command 'certutil -restrict \"certificatetemplate=1.*.*.***.*.*.*.*\" -gmt -out NotAfter,NotBefore,SerialNumber,PublicKeyAlgorithm,SubjectKeyIdentifier,Organization,OrgUnit,CommonName,State,Locality,EMail,Country,DistinguishedName,certificatetemplate,CertificateHash,disposition,RequestAttributes -seconds -view csv' -TimeoutSec 1200
java.util.concurrent.ExecutionException: com.snc.automation_common.integration.exceptions.AuthenticationFailedException: Target is blacklisted. No valid credential found for type [Windows]

Any help is appreciated.

[thiyagu_j]

it seems like configuration is wrong. Can you please check the credentials?

[thiyagu_j]

@jay_rp can you please create TASK. SO that our team will debug and fix the issue.

[Vani14]

@thiyagu_j  
I have followed the same process for discovery of certificates from Microsoft certificate authority, But i am getting error as 

Discovery status is FAILURE, Required attribute fingerprint is missing for CI Type cmdb_ci_certificate

could you please help me on this

[Madhan N]

@thiyagu_j 

I'm able to discover some certs but also receiving below error.

Discovery Log

2023-10-17 18:43:18: Task is running on MID server w12345678-support
2023-10-17 18:43:57: setAttribute(cmdb_ci_certificate,[{}])
2023-10-17 16:48:01: The mid log size is reached the max limit of field size - 4096000
Check Processing Success
2023-10-17 16:48:01: Identification Engine: Discovery status is FAILURE, Identification sections in pattern failed: section: MS CA ID, error: MID Server received a large response that exceed the allowed number of rows 2,000,000..

and 

Discovery log is too large and could not be saved. Log length: 21733502, Max length: 4096000.

[jay_rp]

Fixed the above error by limiting the number of certificates through set limit parameter to 2000. Need to create multiple patterns with each limiting the scope of discovery and it varies based on your certificate length. Ideally you can start with a lower number and find the appropriate limit for your environment 

[Madhan N]

@jay_rp 

Thank you for the response Jay,

Reduced each pattern to 2000 limit and able to discover most of the certs. 
I'm also getting '<error>Unable to process the payload with error message Request body exceeded max allowed content length
Contents of the original payload were moved to D:MIDServeragentworkmonitorsECCSenderoutput_errorecc_queue.087c432047a6f15451a34b09736d1a4b.page_1.xml on the MID server.</error>'

I increased the size of mid.eccq.max_payload_size it stopped error 'Payload size of 79672844 bytes exceeded maximum of 20000000 bytes.' but still getting above error.

[Sanaya1]

Hello @thiyagu_j,

I am also facing an issue while discovering the certificates from MS CA.  Could you please suggest.

[Adriano4]

Hello, when I'm trying to discover the certificates I'm not getting results from the WMI commands:

2024-12-23 15:52:57: Executing WMI command on host: <CA-HOST-IP>, command: tasklist /SVC | findstr /I certsrv

2024-12-23 15:53:01: Command result:

2024-12-23 15:53:01: Execution time: 4432 ms

Debugging directly from the pattern, I tried simpler WMI commands like tasklist only or ipconfig but there's no result.
When I target another host, in the same network, same domain, same domain credentials, I got success.

Any idea about what can be causing the failure in the CA Host?

Thanks!