Scan your network for TLS certificates

A TLS scan finds certificates in use on your network, including certificates that no issuer in ITVA knows about. A probe checks a range of IP addresses or a list of hostnames for open ports, then opens a TLS connection on each open port and records the certificate it gets back. By the end of this guide, you will have run a scan and set it up to run again on a schedule.

Before you begin

• Install a probe that can reach the hosts you want to scan. See Add your first probe.
• Make sure that your firewalls let the probe connect to the ports you scan.

Run a scan

1. In the PKI menu, open Scans.
2. Select New Scan.
3. In Configuration, select Manual to set each option yourself, or Template to use the settings from an application scan template.
4. In Scan Target Type, select CIDR or Hostnames.
5. Type the targets. For CIDR, type one IPv4 range, for example 192.168.1.0/24. For Hostnames, type one hostname per line, or separate them with commas.
6. If you selected Template, select the template in Application Scan Template. If you selected Manual, fill in the scan settings. The next section explains them.
7. Select Submit.

The scan starts immediately. Its status changes from Pending to Processing, then to Succeeded or Failed.

Scan settings

Scanning all 65535 ports takes a long time on a large range. If you know which ports your servers use, for example 443 and 8443, list only those.

If the hosts are far from the probe or on a slow link, increase the timeout. A timeout that is too short makes hosts look offline.

DNS lookup does not query a DNS server during the scan. It uses the DNS records that ITVA already has for your organization. A server can present a different certificate for each hostname, so this option can find certificates that a scan by IP address alone misses.

CIDR limits

• The largest range you can scan is a /19 (8192 addresses). To scan a larger network, run one scan for each /19.
• CIDR scans support IPv4 only. To scan IPv6 hosts, use a hostname scan.
• The probe scans a range larger than a /24 in /24 blocks, one after the other.

Read the results

Open a scan from the Scans list. The Results card shows one TLS application for each host and port that presented a certificate. ITVA also adds each certificate to Certificates and each application to Applications.

ITVA matches certificates by their SHA-256 fingerprint. If a scan finds a certificate that ITVA already has, for example from an issuer sync, ITVA updates that certificate and does not add a copy.

To run the same scan again, open it and select Re-Run Scan. To change some settings first, select Edit & Re-Run. Each run is a new scan in the list.

Save settings in an application scan template

An application scan template stores the probe, ports, timeout, and the two switches. Use one to keep scans consistent, and to scan subnets on a schedule. A template does not store targets.

1. On the Scans page, select New Template.
2. In the New Application Scan Template drawer, type a Name and select a Probe.
3. Add at least one entry in Ports. A template without ports cannot run a scan.
4. Set the timeout and the two switches, then save the template.

Scan a subnet on a schedule

To keep the results current, connect a template to a subnet and add the subnet to a schedule. Each run scans the full CIDR of the subnet.

1. Open the subnet and edit it.
2. Under Application Scan Settings, select the template in Application Scan Template, then save the subnet.
3. Create or edit a subnet schedule, and turn on the Application Scan task. See Create your first schedule.

To scan the subnet once without a schedule, open the subnet and select Run Scan. This also runs the device scan of the subnet, if the subnet has device scan settings.

The same /19 limit applies to subnet scans. If the CIDR of the subnet is larger than a /19, ITVA does not scan it and no scan shows in the Scans list. Split the subnet, or scan its ranges by hand.

Check that it worked

1. Open the Scans page. Make sure that the status of your scan is Succeeded.
2. Open the scan. Make sure that the Results card lists the servers you expected.

Troubleshooting