Skip to content

Agent monitors and internal endpoints

The agent inventories certificates from four bounded source types:

  1. locally configured TLS host/port monitors;
  2. locally configured certificate files;
  3. locally configured Windows certificate stores; and
  4. internal endpoints assigned through CertIntel's platform lease API.

Open Agent Monitors to manage local sources. Platform assignments are managed in CertIntel and appear separately on the agent Overview; they are not copied into local monitor configuration.

Local TLS monitors

Choose Add monitor and enter an FQDN or IP address, port, optional notes and enabled state. The agent makes a TLS connection and inventories the leaf certificate served at that endpoint. It does no subnet scan, port sweep or service discovery.

The observation deliberately accepts expired, self-signed, untrusted and name-mismatched certificates. The purpose is inventory, not application trust validation. Connections use TLS 1.2 or newer and a bounded timeout. Normal HTTPS validation remains enabled for the agent's own CertIntel, ACME and release traffic.

An unreachable endpoint records an observation error and does not prevent other configured sources from being checked.

Platform-assigned endpoints

When managed checks are enabled, the connected agent asks CertIntel for internal endpoints currently due for this machine. Each assignment has a short lease. The agent probes it and returns either certificate metadata or the scan error before the lease expires.

This allows endpoint ownership and scheduling to stay in CertIntel while the TLS connection originates from inside the network. If an assignment is being handled by another agent or is not due, it is not returned. A locally stale copy of a platform observation therefore does not by itself raise an agent attention flag; the platform remains authoritative for lease freshness.

Authentication failure stops platform-assigned work for that scan. Other platform errors are recorded while locally configured monitors continue.

Scan schedule and manual scans

The normal scan interval is 24 hours and can be set from 1 to 720 hours under Settings → API / Server details. Scans are serialized so an interval tick or manual request cannot start overlapping work.

Choose Scan and Report at the top of the app to queue an immediate scan. The activity dialog tracks that job and scrolls to its newest activity. Results also appear in Agent Monitors → Latest discovery results and on Jobs.

CLI equivalents:

certintel-agent certificates discover
certintel-agent certificates inventory --json
certintel-agent jobs get JOB-ID --json

The first command returns a queued job rather than waiting for every network probe and report to finish.

What is reported

Successful observations submit public certificate metadata such as subject, SANs, issuer, thumbprint, validity dates, source/location, hostname/port and configured notes. Private keys, keystore passwords and local API credentials are never included.

Reports are kept in a bounded persistent queue when CertIntel is temporarily unavailable and retried with backoff. A platform authentication error requires credential/approval investigation. Use Test connection, Activity, and certintel-agent diagnostics to distinguish a local scan failure from a reporting failure.

See Certificate stores and files for Windows store filters, notes, supported file formats and protected PKCS#12/JKS passwords.

For a non-Windows host that is not running this agent, the standalone reporting scripts remain available under Internal certificate scanners.