Step 4 of 8

4. Find the certificates you already have

Scan your network to see the servers’ certificates and expiry dates.

What you need

Access to the appliance.
The addresses of the network you want to scan, for example 192.168.1.0/24.

Find certificates on your network

Open Servers › Find servers and click New scan.
Select Network.
Enter the addresses under Networks, one per line. Use IP addresses, a network such as 192.168.1.0/24 or a range such as 10.0.1.1-50.
Keep the selected ports and click Start scan.
Open the result under Scans, then open a finding to see the certificate and expiry date.

Check that it works

The scan shows Completed under Scans. Findings lists the servers found by the scan. A scan does not install or renew certificates.

Next step

Continue with 5. Connect servers.

If it fails

The scan finds no servers → check that the appliance can reach the addresses through the firewall. See The server cannot be reached.
A server is missing → try one address using the name and port the service uses.
An internal name cannot be resolved → configure your internal DNS servers.
The scheduled scan does not run → enable Scan automatically and fill in Networks under Automatic scanning.
Not automated is empty → connect a server and wait for its service agent to report.

Scanning is optional. Continue with the next step above if you know which server needs the certificate. A service agent finds certificates on its own server.

Check one service

Open Servers › Find servers › New scan and select One address. Fill in Name or IP address and Port, for example intranet.example.com and 443. Click Start scan. The result under Scans shows the certificate and a grade for the TLS configuration.

Scan on a schedule

As an administrator, open Servers › Find servers › Automatic scanning and enable Scan automatically. Select How often, enter networks under Networks, separated by commas, and click Save. An empty Ports field uses the default ports. More fields are under Technical settings and in the field reference.

Certificates found on servers

Certificates › Not automated shows valid certificates from service agent discovery, Windows CA and uploads without a profile. They are not renewed automatically. Create an installation plan to automate a certificate.

Expired and replaced certificates appear under Certificates › History.

Monitor a certificate from a file

Open Certificates › Upload certificate, select Certificate file and click Upload certificate. The file can be PEM, CRT, CER, DER, PFX, P12 or JKS, up to 5 MB.

Include the private key, certificate chain and file password if needed. The chain is the intermediate certificates that link the server certificate to a root certificate the browser trusts.

Without a private key, only the expiry date is monitored. With the key, the certificate can be installed. Uploading does not install or renew anything.

Ports scanned by default

The appliance scans the 24 ports below and the ports that installed integrations declare:

22, 25, 110, 135, 143, 389, 443, 445, 465, 587, 636, 993, 995,
1433, 3306, 3389, 5001, 5432, 5985, 5986, 8006, 8080, 8443, 9090

Tick OS detection (no TLS) to only guess the operating system, without reading certificates.

Fields for scheduled scanning

Field	Default	What it does
Ports	empty	An empty field uses the default ports.
Extra TCP ports	empty	Ports that are only checked for being open.
Extra direct TLS ports	empty	Ports where the appliance also reads the certificate.
Retention (days)	90	Scans, and discovered servers that have not been enabled, are deleted after this many days.
TCP probe threads	3	How many connections the scan attempts at the same time.
Delay between batches (ms)	0	A pause between each batch of connections, so the network carries less load.