Interested in a ServiceNow event built for developers? Registration for now[dev]26 is officially open!

IP-based Certificate Discovery - How are Certificates related to Servers(CMDB CI) in OOTB CIM?

Dinh Nguyen
Kilo Sage

yesterday

Hi everyone,
I'm investigating the OOTB behavior of Certificate Inventory and Management (CIM) when running IP-based Certificate Discovery.
From my understanding, the discovery process retrieves certificate information through the TLS Port Probe and stores certificate-related data within CIM. However, I'm trying to understand how the discovered certificates are associated with the server where the certificate is deployed.
  • Does discovery collect both certificate information and server/host information?
  • Are certificates and servers stored in separate tables?
  • How does CIM relate a discovered certificate to the server where it is deployed?
  • Is there a reference field or relationship table between Certificate records and CMDB CIs?
  • Which tables/fields should be checked to verify this relationship?

Please someone help me.

Thankyou!

0 Helpfuls
  • 183 Views
2 REPLIES 2

Pratiksha
Mega Sage

yesterday

 

  • Does discovery collect both certificate information and server/host information?
    Yes. With IP-based Certificate Discovery, the TLS Port Probe retrieves the certificate information from the target IP/port. If valid credentials are available and host discovery is also performed, Discovery can collect the corresponding server/host information and identify the CI in the CMDB.

  • Are certificates and servers stored in separate tables?
    Yes. Certificate information is maintained in the certificate-related CIM tables, while the server/host is represented as a CI in the CMDB (cmdb_ci) and the relevant child class, such as cmdb_ci_server.

  • How does CIM relate a discovered certificate to the server where the certificate is deployed?
    The association is through the Installed on relationship. The certificate record identifies the CI/server on which the certificate is installed, allowing CIM to associate the certificate with the corresponding CMDB CI.

  • Is there a reference field or relationship table between Certificate records and CMDB CIs?
    The relationship is represented through the Installed on association. From the CMDB side, the relationship can be investigated in the CI Relationship (cmdb_rel_ci) table.

  • Which tables/fields should be checked to verify this relationship?
    I would start by checking:

    1. The certificate record in the CIM certificate table.

    2. The Installed on field/association on the certificate record.

    3. The corresponding CI in cmdb_ci / cmdb_ci_server.

    4. The cmdb_rel_ci records to verify the relationship between the certificate-related record and the CI.

    5. The Discovery/Probe results to verify the IP address and port from which the certificate was discovered.

So, in short, the certificate and server are maintained as separate records, and CIM uses the "Installed on" association to identify where the certificate is deployed. The CMDB relationship data can then be validated through cmdb_rel_ci.

One thing to keep in mind is that for IP-based discovery, the TLS certificate can be retrieved from the endpoint through the TLS Port Probe without requiring OS credentials. Credentials are relevant when Discovery needs to access the server itself and collect additional host/CI information.

 

Hope this helps. 

 

Pratiksha

Dinh Nguyen
Kilo Sage
In response to Pratiksha

3 hours ago

Hi @Pratiksha ,

Thank you very much for your response.

So, if I understand correctly, IP-based Certificate Discovery can discover both the certificate information and the server/host where the certificate is deployed. Also, the certificate and the server/host are stored as two separate records, right?

I checked this in my instance and did not find an Installed on field reference to CMDB CIs on the Unique Certificates [cmdb_ci_certificate] table.

However, I found the Installed Certificates [sn_disco_certmgmt_cmdb_installed_certificate] table, which contains a Server field that references the cmdb_ci_server table.

Does this mean that after running IP-based Certificate Discovery, deployed certificates are recorded in the Installed Certificates table, and the Server field represents the server on which the certificate is deployed?

If my understanding is correct, then can I rely on the below documentation alone for configuring:

[Run IP-based certificate discovery • Australia IT Operations Management • Docs | ServiceNow]

Thank you for your help and clarification.

0 Helpfuls