PKI and CLM overview

ITVA keeps one inventory of the certificates in your environment. You find it under Inventory > PKI. This page explains the three ways that certificates get into the inventory, and how they work together.

How ITVA gets certificates

• Scans find the certificates that your servers and applications present on the network.
• Enrollment requests a new certificate from your certificate authority (CA). ITVA can then install the certificate and renew it before it expires.
• CA sync imports data that your CA already has, such as the certificates it issued or its certificate templates.

Scans

A TLS scan finds certificates by connecting to them. The probe that you select opens a TLS connection to each host and port in the scan target. It records the certificate that the server presents. The scan does not use credentials, so it finds only the certificates that servers present on the network.

The scan target is a CIDR or a list of hostnames. You also set the ports to scan, for example 443 or 1-1024. A CIDR scan first finds the live hosts, then the open ports on each host, and then makes the TLS connections. One CIDR scan can cover a /19 network at most.

If Enable DNS lookup is on, ITVA finds the hostnames for each IP address in the DNS records that it synced. The probe then scans each hostname too. This finds certificates that a server presents only for a specific name. DNS lookup is on by default.

For each certificate, ITVA records the subject, subject alternative names, issuer, validity dates, public key algorithm and size, and the chain that the server sent. For each host and port, ITVA records the TLS version, cipher suite, and key exchange of the connection. ITVA shows each host and port as a TLS application on the Applications page. The Encryption report uses this data to show your quantum readiness.

To run a scan one time, select New Scan on the Scans page. To scan a subnet on a schedule, give the subnet an Application Scan Template. Then create a subnet schedule that runs the Application Scan task.

Enrollment

Enrollment is how ITVA issues certificates. ITVA sends a request to your CA and stores the certificate that comes back. ITVA can then install the certificate and renew it for you.

Issuers and CA templates

An issuer is a CA that ITVA connects to. You add issuers on the Issuers page. ITVA supports two kinds of issuer:

• Active Directory Certificate Services: ITVA runs commands on the CA's Windows server over WinRM, through the server's probe. Add the server to ITVA as a device first. See Add a Windows ADCS issuer.
• DigiCert: ITVA uses the DigiCert CertCentral API with an API key credential. See Add a DigiCert issuer.

Each issuer has CA templates. A template sets the defaults for a certificate: the extended key usages, the organization details, and the private key algorithms that are allowed. A new template is off. A user who can manage templates turns it on with the Enabled switch. Other users see only enabled templates.

Requests and approval

To get a new certificate, a user creates an enrollment request and selects a template. The request shows on the Tools > Certificate Change Request page. A user who can manage change requests approves or rejects it. You can also add enrollment requests to a ticket with the category Certificate Request.

When a request is approved, ITVA creates an enrollment. The enrollment holds the certificate details and every certificate that ITVA issued for it. To get the first certificate, open the enrollment on the Enrollments page and select Issue.

Private keys

When you issue a certificate, you select where the private key comes from:

• ITVA Generated Private Key: ITVA generates the key and stores it.
• Generate on Device: ITVA generates the key and the certificate signing request (CSR) on a Linux or Windows server that ITVA manages. The key stays on the server.
• Provide a CSR: you paste a CSR. ITVA never has the private key.
• Provide a Private Key: you paste a private key and its password. ITVA makes the CSR and stores the key.

ITVA supports RSA keys of 2048, 3072, 4096, and 8192 bits, ECDSA keys of 256, 384, and 521 bits, and the post-quantum ML-DSA-44, ML-DSA-65, and ML-DSA-87. The template can limit which algorithms you can use. To generate an ML-DSA key on a device, the device must be a Linux server with OpenSSL 3.5 or later.

Installs

An install sends the certificate to the place where it is used. There are two methods:

• SSH: the probe copies the certificate to a path on a server. ITVA can then run a script on the server, for example to restart a service.
• HTTP: ITVA sends the certificate to an API with one or more HTTP requests.

If Auto Install is on, ITVA installs the certificate again each time it is renewed or reissued.

Renew, reissue, and revoke

Auto-renew is off by default. If you turn on Auto Renew for an enrollment, ITVA renews the certificate 14 days before it expires. About a week before the renewal, ITVA sends an email reminder to the organization administrators. Auto-renew cannot renew a certificate that was issued from a pasted CSR. For these certificates, paste a new CSR each time you renew.

You can reissue a certificate at any time. If you change the common name or the subject alternative names, the reissue becomes a change request that needs approval.

To revoke a certificate, you submit a revoke request, which also needs approval. You can revoke certificates from Active Directory Certificate Services issuers only. ITVA does not revoke DigiCert certificates.

Sync from a certificate authority

A CA sync imports data from an issuer into ITVA. To start a sync, open the issuer on the Issuers page and select Sync. ITVA does not sync issuers on a schedule, so sync again when the CA changes.

What a sync imports depends on the kind of issuer:

• Active Directory Certificate Services: the certificate templates on the CA. The sync does not import the certificates that the CA issued. To find those certificates, scan the servers that use them.
• DigiCert: the SSL/TLS certificates that DigiCert issued for your account, with their chains. ITVA skips certificates that expired more than 365 days ago. The sync does not import templates. You create DigiCert templates in ITVA.

ITVA adds each DigiCert certificate to an enrollment under the issuer, with one enrollment for each common name. ITVA does not have the private keys of synced certificates. To renew a synced certificate from ITVA, select Renew on its enrollment and select a key source.

Compare scans, enrollment, and CA sync

How the inventory fits together

ITVA identifies each certificate by its SHA-256 fingerprint. If a scan finds a certificate that ITVA issued or synced, ITVA keeps one record for it. That record links to the issuer and to each TLS application where the scan found the certificate.

The tiles at the top of the Certificates page filter the list by where a certificate came from:

• ITVA Issuer: certificates that link to an issuer in ITVA, from enrollment or CA sync.
• Mapped Application: certificates that a scan found on at least one TLS application.
• Mapped Application & ITVA Issuer: certificates that are in both groups.

A certificate with no ITVA issuer came only from a scan. ITVA shows it and its expiry date, but cannot renew or install it.

Each certificate has one status: Valid, Expires Soon (it expires in the next 30 days), Expired, or Revoked.