Skip to content

Agent monitors and internal endpoints

The agent inventories certificates from five bounded source types:

  1. locally configured TLS probes (host and port);
  2. locally configured certificate files;
  3. locally configured Windows certificate stores;
  4. CRL distribution points - registered on the platform's CRL Distribution Points page or configured locally (crl_monitors: id, source, notes, enabled), read on the scan schedule and reported as CRL Distribution Point - Agent, with their revoked entries. See CRL monitoring; and
  5. internal endpoints assigned through CertIntel's platform lease API.

Open Agent Monitors to manage local sources. Platform assignments are managed in CertIntel and appear separately under Cloud-assigned monitor results on the agent Overview; they are not copied into local monitor configuration.

In CertIntel, open Internal Endpoints (the page is titled Internal TLS Probe - Cloud) and expand Add an internal endpoint. Enter its hostname or IP, port (default 443), an optional Label, the Organization, and Check every (hours) (1–720, default 24). Use Recheck to request an earlier check, Pause to stop scheduling it, and Resume to continue. The page shows last/next check times and Pending (never checked), OK, Failed, Checking, Paused, or Skipped by certificate policy status. A failed check is retried after one hour (or the interval, if shorter) rather than waiting for the full interval, by whichever of the organization's agents asks first; Recheck still makes it due at once.

A single-label intranet name such as nas01 is accepted and probed, and so is a name with -- in the third and fourth characters of a label (an internationalized xn-- name). Adding an endpoint refuses hosts no agent can probe: an IPv6 address with a zone (Enter the IPv6 address without a zone (%...): agents cannot probe it.) and a name whose last label is all digits, such as 12345 or 10.0.0 (Enter a DNS hostname whose last label is not all digits, or a full IP address.).

Deleting or pausing an endpoint while an agent is probing it, or a result that arrives after its lease ran out, does not disturb the agent's other checks: CertIntel accepts that result as discarded, records nothing from it and leaves the endpoint as it is.

Local TLS probes

Choose Add TLS probe… and enter an FQDN or IP address, port, optional notes and enabled state. The agent makes a TLS connection and inventories the leaf certificate served at that endpoint. It does no subnet scan, port sweep or network service discovery.

The Agent can also read the web and service configuration of the machine itself to pre-fill a new workflow (Server detection). That is local and read-only and does not probe the network. A short list of the servers found is reported to CertIntel unless that is turned off on the device (see What the Agent reports to CertIntel); it is not added to the certificate inventory.

The observation deliberately accepts expired, self-signed, untrusted and name-mismatched certificates. The purpose is inventory, not application trust validation. Connections use TLS 1.2 or newer and a bounded timeout. Normal HTTPS validation remains enabled for the agent's own CertIntel, ACME and release traffic. Agent probes are not graded: the TLS grade covers sites CertIntel monitors from the platform only.

An unreachable endpoint records an observation error and does not prevent other configured sources from being checked.

On Windows, adding or changing a probe's host or port is a security-sensitive change: the app asks for administrator approval and lists the target (Add TLS monitor … targeting host:port) before saving. Editing notes or the Enabled box does not need the second confirmation.

Platform-assigned endpoints

Platform-assigned checks are on by default. Turn them on or off with Check internal endpoints assigned by CertIntel on the agent Overview (Windows) or with m on the Agent Monitors screen of the Linux terminal interface. Enabling it is a security-sensitive change that asks for administrator approval on Windows.

When enabled, the connected agent asks CertIntel for internal endpoints currently due for this machine on its own schedule (Settings → Schedules → Check interval (minutes, 5–1440), default 60), independently of the local scan interval. That interval only sets how often the agent asks; CertIntel decides how often each endpoint is probed and hands out a short lease. The agent probes it and returns either certificate metadata or the scan error before the lease expires. A lease with less than 15 seconds left is reported as failed without probing (The scan lease expired before this agent could start the check; verify the agent and platform clocks.).

This allows endpoint ownership and scheduling to stay in CertIntel while the TLS connection originates from inside the network. If an assignment is being handled by another agent or is not due, it is not returned. A locally stale copy of a platform observation therefore does not by itself raise an agent attention flag; the platform remains authoritative for lease freshness.

Authentication failure stops platform-assigned work for that scan. Other platform errors are recorded while locally configured monitors continue.

Scan schedule and manual scans

The normal scan interval is 24 hours and can be set from 1 to 720 hours under Settings → Schedules → Scan interval (hours, 1–720). Scans are serialized so an interval tick or manual request cannot start overlapping work. This interval controls locally configured TLS, file, and store monitors. A manual Scan and Report includes those monitors and due platform assignments; Scan now on the Schedules row does the same, and Check now next to the internal-endpoint row asks CertIntel for due assignments immediately.

Choose Scan and Report at the top of the app to queue an immediate scan. The activity dialog tracks that job and starts at the top of the log. New activity preserves the reading position unless Follow latest activity is enabled. Results also appear in Agent Monitors → Latest discovery results and on Jobs.

CLI equivalents:

certintel certificates discover
certintel certificates inventory
certintel jobs get JOB-ID

The first command returns a queued job rather than waiting for every network probe and report to finish; it prints its job ID and how to follow it, and inventory and jobs get print a short table or summary. Add --json for the service's whole answer.

Post-install re-check

After the agent installs a managed certificate, it re-probes any enabled local TLS probe whose host is one of the new certificate's names (configured domains or SANs, including one-label wildcards) and reports the result, so the inventory shows the new thumbprint right away. The activity entry post-install-recheck lists each endpoint as serving the new certificate, still serving a different certificate or no certificate observed. The re-check is observation only and never changes the deployment.

Platform-assigned endpoints the agent has probed before are re-checked the same way when the platform offers on-demand re-checks; otherwise the agent records post-install-recheck-skipped and those endpoints refresh on their regular schedule. Turn the behaviour off with After installing a managed certificate, re-check monitored TLS endpoints it covers under Settings → Schedules (Windows) or c on the Linux Agent Monitors screen.

Served versus issued

CertIntel compares each internal endpoint with the managed certificate last issued for its hostname, as it does for public endpoints (see Served versus issued). It applies to every certificate an Agent reports as issued or renewed, from a public ACME CA or from the organization's Private CA.

  • Linked automatically. A successful renewal links every internal endpoint of the same organization whose hostname the certificate's subject or SANs cover; a wildcard covers one label. An endpoint added later is linked when it is added.
  • Linked by hand. The endpoint's detail has an Expected certificate section: choose the certificate under Link a managed certificate and select Link. Unlink stops the check for that endpoint and certificate; unlinking an automatic match keeps a record of the decision, so later renewals do not link it again. Both need internal_endpoints.update.

An internal endpoint is probed by an Agent, not by CertIntel, so CertIntel only knows what the last probe saw:

Status Meaning
serving the latest certificate A probe since the renewal saw the renewed certificate.
renewed, not checked since the renewal No Agent has probed the endpoint since the renewal. When the renewal is reported CertIntel marks the covered endpoints as due, and an Agent of the organization probes them the next time it asks for work (hourly by default).
renewed, not served yet A probe since the renewal still saw another certificate, and the renewal is newer than the grace period (24 hours by default). Three hours before the grace period ends, CertIntel asks for one more probe if the last one is older than that.
serving an old certificate The grace period has passed and the endpoint still served another certificate at its last probe.
not compared yet There is nothing to compare yet.

The Internal Endpoints list shows the status as a pill and filters on it with Expected certificate (serving an old certificate, or renewed, not served or not checked yet).

On a mismatch: the service probably still has the old certificate loaded, so reload or restart it. If it serves the old certificate again afterwards, the renewed certificate was not installed where the service reads it: check the deployment step of the workflow that renewed it, on the Renewals page. Then select Recheck; the status changes when an Agent has checked the endpoint again.

An endpoint serving an old certificate raises the monitor.served_mismatch alert, Public or internal endpoint still serving an old certificate (see Alerts). A paused endpoint is not alerted on. On the Clients page, Served mismatches counts public and internal endpoints together, and each of the two lists says how many endpoints of the other kind serve an old certificate, with a link.

The API lists, adds and removes links with GET/POST /api/v1/internal-endpoints/{id}/certificate-links and DELETE /api/v1/internal-endpoints/{id}/certificate-links/{link_id}.

What is reported

Successful observations submit public certificate metadata such as subject, SANs, issuer, thumbprint, validity dates, source/location, hostname/port and configured notes, plus the presented certificate chain (up to ten certificates) so the dashboard can build and validate certification paths. Private keys, keystore passwords and local API credentials are never included.

The chain is sent exactly as captured whenever it is well formed (the leaf matches the first member, at most ten members, each parseable). It is submitted regardless of the ignore list: the list only decides which CA certificates the agent reports as inventory of their own. The certificate detail shows the agent's chain evidence line (captured versus submitted members and the reason) when a chain was withheld.

Reports are kept in a bounded persistent queue (up to 1,000 reports or 4 MiB) when CertIntel is temporarily unavailable and retried with backoff. A platform authentication error requires credential/approval investigation. Use Test connection, Activity, and certintel diagnostics to distinguish a local scan failure from a reporting failure.

See Certificate stores and files for Windows store filters, notes, supported file formats and protected PKCS#12/JKS passwords.

For a non-Windows host that is not running this agent, the standalone reporting scripts remain available under Internal certificate scanners.