# Discover Certificates in your Network

You can automatically discover all the certificates available in your network using Key Manager Plus, irrespective of the CA. You can discover the certificates anytime as needed or periodically based on scheduled tasks. The discovery options are quite flexible - you can discover certificates from a single server or multiple servers, and from multiple ports, at one go. Key Manager Plus also allows users to rediscover the expired and about-to-expire certificates from the 'Certificate Expiry' widget in the dashboard.

1. [Configuring Discovery Settings](#1-configuring-discovery-settings)
2. [SSL Discovery Methods Available in Key Manager Plus](#2-ssl-discovery-methods-available-in-key-manager-plus)
   1. [Discover SSL Certificates on Demand](#21-discover-ssl-certificates-on-demand)
   2. [Discover SSL Certificates Automatically through Schedules](#22-discover-ssl-certificates-automatically-through-schedules)
   3. [Discover Certificates Mapped to User Accounts in Active Directory](#23-discover-certificates-mapped-to-user-accounts-in-active-directory)
   4. [Manage Certificates from MS Certificate Store and Local CA](#24-manage-certificates-from-ms-certificate-store-and-local-ca)
   5. [Discover SSL Certificates from SMTP Servers](#25-discover-ssl-certificates-from-smtp-servers)
   6. [Discover SSL Certificates from Load Balancers](#26-discover-ssl-certificates-from-load-balancers)
   7. [Discover SSL Certificates from a Shared Directory Path](#27-discover-ssl-certificates-from-a-shared-directory-path)
   8. [Discover SSL Certificates using KMP Agents](#28-discover-ssl-certificates-using-kmp-agents)
   9. [Discover SSL Certificates Hosted on AWS (ACM & IAM)](#29-discover-ssl-certificates-hosted-on-aws-acm--iam)
3. [Rediscover SSL Certificates](#3-rediscover-ssl-certificates)
4. [Centralized Certificate Repository](#4-centralized-certificate-repository)
5. [Export Private Key / Keystore File](#5-export-private-key--keystore-file)
6. [Update Servers with Latest Certificate Versions](#6-update-servers-with-latest-certificate-versions)

## 1. Configuring Discovery Settings

**Note:** Discovery settings are aplicable from build 7010 and above only.

Key Manager Plus automatically discovers SSL certificates using default discovery settings. However, users can customize these settings to optimize efficiency and performance based on their specific requirements.

To manually configure SSL discovery settings:

1. Navigate to the **Discovery** tab and select **SSL**.
2. Click on **Discovery Settings** to access the configuration options.
3. Adjust the following parameters as needed:
   - **Thread Count** - Define the number of concurrent discovery processes to enhance efficiency.
   - **Connection Timeout** - Set the maximum wait time for establishing a connection during discovery.
   - **DNS/IP Resolve Timeout** - Specify the duration for resolving domain names or IP addresses.
4. Click **Save** to apply the changes.

![cert-disc-settings](https://www.manageengine.com/key-manager/help/images/ssl-discovery-settings.png)

If you have set the thread count above 20, you may experience performance issues when Key Manager Plus executes large operations alongside the SSL discovery. In such cases, increase the application memory for Key Manager Plus:

1. Navigate to the **<Key-Manager-Plus-Installation-Directory>/conf** folder and open the **wrapper.conf** file.
2. Increase the allocated memory by editing the default values of **initmemory** and **maxmemory** as shown below:

```
# Initial Java Heap Size (in MB)
wrapper.java.initmemory=1024
# Maximum Java Heap Size (in MB)
wrapper.java.maxmemory=1024
```

3. Save the **wrapper.conf** and restart the Key Manager Plus application.

![cert-disc-settings-2](https://www.manageengine.com/key-manager/help/images/ssl-discovery-settings-2.png)

Customizing these settings allows users to optimize SSL discovery based on network conditions and performance requirements.

## 2. SSL Discovery Methods Available in Key Manager Plus

### 2.1 Discover SSL Certificates on Demand

**Note:** From build 7150 onwards, Key Manager Plus automatically identifies and displays the **Web Server Type** for discovered certificates, if available in the server response header.

To discover certificates manually:

1. Go to the **Discovery** tab in the GUI.
2. Click the **SSL** tab.
3. Select an option for the type of discovery:
   1. **Hostname/IP address** - Enter the name or IP address of the server.
   2. **IP address range** - Specify an IP range.
   3. **From file** - Load a text file containing server details.
   4. **Subnet** - Discover resources from specific subnet works within an IP range.
4. For SSL Hostname discovery, specify hostname and IP separated by a colon (`example.com:168.203.56`). If no port is specified, default port 443 is used.

   **Note:** The file to be imported should be a text file containing hostname or IP addresses on separate lines. Enter ports separated by a space:

   ```
   0.0.0.0 6565
   test-username-10 443
   192.168.20.20 7272
   ```

5. For bulk discovery using **IP address range** and **Subnet**, use the **Exclude IP Address** field to exclude specific resources.
6. Specify values for:
   1. **Time out** - Default is 5 seconds.
   2. **Port** - Default is **443**.

   **Notes:**
   - Multiple ports can be specified, separated by commas.
   - Exclude certificates via **Settings >> SSL >> Excluded Certificates**.
7. Select **Bypass Proxy Settings** to bypass proxy configured under [Admin Settings](https://www.manageengine.com/key-manager/help/network-settings.html).
8. Click **Discover** to begin.

![cert-manage-1](https://www.manageengine.com/key-manager/help/images/cert-manage-1.png)

### 2.2 Discover SSL Certificates Automatically through Schedules

**Note:** From build 7150 onwards, Web Server Type is identified for certificates discovered through schedules.

To schedule SSL discovery:

1. Click the **Schedule** tab.
2. Click **Add Schedule**.
3. Enter a **Name** and select **Schedule Type** as **SSL Discovery**.
4. Specify **Start IP**, **End IP**, and **Port**.
5. Select **Recurrence Type** - hourly, daily, weekly, monthly, or once only.
6. Enter email addresses for notifications. Configure mail settings under **Settings >> General Settings >> Mail Server**.
7. Click **Save**.

Results appear in the **Schedule Audit** and **Discovery Audit** tabs.

### 2.3 Discover Certificates Mapped to User Accounts in Active Directory

To perform AD user certificate discovery:

1. Navigate to **Discovery >> AD User Certificate**.
2. Select the required **Domain Name**.
3. Specify the DNS name of the **Primary Domain Controller**.
4. Optionally specify **Secondary Domain Controllers** (comma-separated).
5. Enter valid **User Name and Password**, and specify users/groups/OUs.
6. Enable **Import AD users** if required.
7. Click **Import**.

Discovered certificates are added to the repository.

![cert-manage-2](https://www.manageengine.com/key-manager/help/images/cert-manage-2.png)

### 2.4 Manage Certificates from MS Certificate Store and Local CA

To import certificates:

1. Navigate to **Discovery >> MS Certificate Store**.
2. Choose discovery type:
   - **Certificate Store**
   - **Microsoft Certificate Authority**
3. Discover using:
   1. **Server Name**
   2. **IP Address Range**
   3. **From File**

   Example file format:

   ```
   242.209.75.62
   webserver-099
   Agent:webserver-099
   ```

4. Provide authentication details.
5. Specify store name format: `\\server_name\store_name`
   - `server_name\Root`
   - `server_name\My`
6. Click **Discover**.

You can filter by date, template name/OID, and include expired/revoked certificates.

![cert-manage-3](https://www.manageengine.com/key-manager/help/images/cert-manage-3.png)

### 2.5 Discover SSL Certificates from SMTP Servers

1. Navigate to **Discovery >> Mail Server Certificate**.
2. Provide **Hostname/IP Address** and **Port** (comma-separated if multiple).
3. Click **Discover**.

![smtp-discovery](https://www.manageengine.com/key-manager/help/images/smtp-discovery.png)

### 2.6 Discover SSL Certificates from Load Balancers

Supports Linux-based load balancers (Nginx, F5, Citrix, etc.) via SSH.

1. Navigate to **Discovery >> Load Balancer**.
2. Select type: **General**, **BIG-IP F5**, **Citrix**, or **FortiGate Firewall**.
3. Provide server details and authentication.
4. Optionally use key-based authentication.
5. Click **Discover certificate list**, select required certificates.
6. Click **Discover**.

![load-balancer-discovery](https://www.manageengine.com/key-manager/help/images/load-balancer-discovery.png)

Citrix can also use REST API with optional proxy bypass.

![load-balancer-discovery2](https://www.manageengine.com/key-manager/help/images/load-balancer-discovery2.png)

FortiGate requires API Key authentication.

![FortiGate Firewall Discovery](https://www.manageengine.com/key-manager/help/images/fortigate-2.png)

#### Manual Import of Certificates from JKS/PKCS Files

1. Select **JKS/PKCS**.
2. Choose certificate file.
3. Provide passphrase.
4. Click **Import**.

#### Automatic Import of Certificates from JKS/PKCS Files

1. Click **Assign Passwords**.
2. Upload file containing filenames and passwords:

   ```
   test.keystore, P@ss#123
   ```

3. Click **Save Credentials**.

![assign-passwords](https://www.manageengine.com/key-manager/help/images/assign-paswords-2.png)

![assign-passwords-2](https://www.manageengine.com/key-manager/help/images/assign-paswords-3.png)

### 2.7 Discover SSL Certificates from a Shared Directory Path

1. Navigate to **Discovery >> Shared Path**.
2. Choose **Windows** or **Linux/Mac OS**.
3. Provide server details and directory path.
4. Click **Discover certificate list**.
5. Select certificates and click **Discover**.

**Note:** Certificate files over 30 KB will not be imported.

![cert-manage-sharedpath](https://www.manageengine.com/key-manager/help/images/cert-manage-sharedpath.png)

![cert-manage-sharedpath2](https://www.manageengine.com/key-manager/help/images/cert-manage-sharedpath2.png)

### 2.8 Discover SSL Certificates using KMP Agents

Agents are available for Windows servers.

To discover via agent:

1. Navigate to **Discovery >> Agent**.
2. Choose type: **DMZ**, **Certificate Store**, or **Microsoft Certificate Authority**.
3. Select agent.
4. Provide required details.
5. Click **Discover**.

![agent-based-discovery](https://www.manageengine.com/key-manager/help/images/agent-based-discovery-2.png)

To discover from remote directory path:

1. Navigate to **Discovery >> Agent**.
2. Choose **Directory**.
3. Select agent.
4. Specify directory path.
5. Click **Discover certificate list** and then **Discover**.

![cert-manage-agent](https://www.manageengine.com/key-manager/help/images/cert-manage-agent.png)

### 2.9 Discover SSL Certificates Hosted on AWS (ACM & IAM)

#### Step 1: Configure AWS Credentials

1. Navigate to **Discovery >> AWS >> Manage AWS Credential**.
2. Click **Add**.
3. Provide **Credential Name, Access Key, Secret Key**.
4. Use **Test Login**.
5. Click **Save**.

#### Step 2: Discovery and Import

1. Go to **Discovery >> AWS**.
2. Select credentials.
3. Choose service: **ACM** or **IAM**.
4. Select region (for ACM).
5. Click **Discover**.
6. For IAM, specify usernames or use **List AWS UserNames**.

![aws-discovery](https://www.manageengine.com/key-manager/help/images/aws-discovery.png)

## 3. Rediscover SSL Certificates

From build 6000 onwards:

1. Navigate to **SSL** tab.
2. Select certificates.
3. Click **More >> Re Discover**.

![rediscover](https://www.manageengine.com/key-manager/help/images/rediscover.png)

Track status in **Discovery Audit**.

## 4. Centralized Certificate Repository

All discovered certificates are automatically added to the centralized repository. View them under **SSL >> Certificates**.

### 4.1 Search SSL Certificates

Search using **Common Name, DNS Name, Issuer, Key Size, Signature Algorithm, Description, additional fields**, etc.

1. Navigate to **SSL >> Certificates**.
2. Use the search icon.

Additional fields documentation:  
https://www.manageengine.com/key-manager/help/additional-fields.html

![ssl-cert-repository](https://www.manageengine.com/key-manager/help/images/ssl-cert-repository.png)

## 5. Export Private Key / Keystore File

Click the Keystore icon beside certificates managed by Key Manager Plus.

![keystore](https://www.manageengine.com/key-manager/help/images/keystore-icon.png)

To export:

1. Navigate to **SSL >> Certificates**.
2. Click the **Keystore** icon.
3. Choose:
   1. **Export Keystore / JKS**
   2. **Export PKCS12/PFX**
   3. **Export PEM**
   4. **Export Private Key**
4. The certificate is downloaded in selected format.

## 6. Update Servers with Latest Certificate Versions

1. Navigate to **SSL >> Certificates**.
2. Click the multiple servers icon beside the certificate.

![multiple-server](https://www.manageengine.com/key-manager/help/images/multiple-server-icon.png)

3. Review listed servers and validity.
4. Select server and click **Deploy**. Refer to detailed deployment procedure:  
https://www.manageengine.com/key-manager/help/deploy-ssl-certificates.html
5. Click **Add** to add a new server.
6. Provide **DNS Name, IP Address, Port**.
7. Click **Save**.
8. Use **Check Status** to verify sync status. Learn more:  
https://www.manageengine.com/key-manager/help/admin-settings.html#certsync

![multiple-servers](https://www.manageengine.com/key-manager/help/images/multiple-servers.png)