Skip to content

Monitoring certificate stores and files

The Agent Monitors page can inventory certificates that are installed on disk but are not necessarily served from a network port. Store and file monitoring is read-only: it extracts public certificate metadata and never exports a private key.

Windows certificate stores

Choose Add store and configure:

  • Location — LocalMachine or CurrentUser;
  • Store name — select a discovered store or type another valid store name;
  • Names — optional comma-separated CN/DNS SAN filters;
  • Notes — optional ordered pattern=note mappings; and
  • Enabled — whether scheduled and manual scans include the store.

CurrentUser means the identity running the service, normally LocalSystem. It does not mean the administrator who opened the desktop app.

Name filters are case-insensitive and match the subject common name or a DNS SAN. Each * consumes one or more characters within one DNS label; it does not cross a dot. Leave Names empty to inventory the whole store. The first matching Notes rule adds its note to the reported observation.

Store enumeration is bounded to 4,096 certificates and at most 1,000 selected observations per configured store.

Common stores

Cert:\ path Typical contents
Cert:\LocalMachine\My Computer personal certificates, commonly including IIS/service leaf certificates.
Cert:\LocalMachine\WebHosting IIS web-hosting leaf certificates.
Cert:\LocalMachine\Remote Desktop RDP listener certificates.
Cert:\LocalMachine\CA Intermediate/issuing CA certificates.
Cert:\LocalMachine\Root Trusted self-signed roots.
Cert:\LocalMachine\AuthRoot Microsoft third-party roots.
Cert:\LocalMachine\TrustedPeople Explicitly trusted end-entity certificates.
Cert:\LocalMachine\TrustedPublisher Trusted code/macro publishers.
Cert:\LocalMachine\Disallowed Explicitly distrusted certificates.
Cert:\CurrentUser\My Personal certificates for the service identity.

These trust stores are valid monitoring sources. Root, CA, AuthRoot and Disallowed are deliberately not offered as certificate deployment destinations.

Certificate files

Choose Add file and browse to one exact absolute file path. Add notes and an enabled state just like the other monitors.

Supported files:

Extension Reading behavior
.pem, .crt Parses public PEM certificate blocks. A combined certificate/private-key PEM is rejected.
.cer, .der Parses a DER public certificate.
.p7b, .p7c Parses a PKCS#7 public certificate collection.
.pfx, .p12 Opens a PKCS#12 archive using the protected password configured for this monitor.
.jks Runs the selected Java keytool against the configured alias using the protected keystore password.

Files must be regular files and are limited to 4 MiB. The agent verifies that the same file remains open during the bounded read. It does not follow a configured directory or discover sibling files.

PKCS#12 and JKS passwords are sent to the service through the local protected API, encrypted at rest, and never displayed again. When editing, leave the password blank to keep the existing value. JKS requires an absolute keytool path, an alias, and a password of at least six characters. keytool receives the password through an environment variable rather than a command-line argument.

Monitoring a JKS starts a Java process and may use more CPU than reading a public certificate file. Other configured scans are normally lightweight.

Run and inspect a scan

Choose Scan and Report at the top of the desktop app. The resulting job shows the activity for that scan, while Latest discovery results shows the last local observations.

certintel-agent certificates discover
certintel-agent certificates inventory --json

Reported data includes certificate subject/SANs, issuer, thumbprint, validity, source/location, configured notes and machine identity. Private keys and archive passwords are not reported.

Store monitoring versus deployment

Monitoring reads whatever already exists. A certificate workflow's Windows certificate store destination performs a privileged installation into a Local Computer personal store, can keep the private key non-exportable, and can grant selected principals private-key read access. See Certificate workflows and deployment for that separate operation.