Skip to content

Certificates

The Certificates page is the unified inventory every source feeds into: public endpoint probes, internal scanners, ACME renewals, and Certificate Transparency log hits all land in the same list, deduplicated by fingerprint within each organization. A certificate seen by more than one source shows every sighting on its detail view - so a cert that started life as an ACME renewal but later turned up on an internal scanner shows both.

  • The default search matches the subject common name and SANs - the common case of "find the cert for this hostname."
  • Switch Search in to All fields to also match issuer, serial number, SHA-256 fingerprint, and subject/issuer distinguished name - useful when you're tracking down a specific certificate by something other than its hostname.

Filtering

Filter by Source (public endpoint, internal scan, ACME renewal), Expiry tier (expired, critical, warning, upcoming), and Acknowledged state. Certificates you've acknowledged are hidden by default until you explicitly ask to see them.

Last seen

Every row shows how long ago it was last reported, from any source - the most recent of a public probe, an internal scan, or an ACME renewal touching that exact certificate. A certificate that stops being reported (a decommissioned host, a retired scanner) will show a growing "last seen" age even if nothing else about it changes.

Acknowledging and pausing

  • Acknowledge hides a certificate from expiry alerts everywhere, with an optional reason - use it for a certificate you know about and don't need reminders on (a deliberately long-lived internal root, for example). Unacknowledge resumes alerting.
  • For an internally-scanned certificate specifically, you can pause alerts from just one reporting host without acknowledging the certificate everywhere else - useful when one machine's scan is noisy but the certificate itself still matters elsewhere.

Bulk actions

Select multiple rows with the checkboxes to acknowledge or delete them in one action, with an optional shared reason for a bulk acknowledge. Deleting a certificate here doesn't block it from reappearing - if a scanner or agent reports it again, it's simply re-added to the inventory.

Exporting

Export CSV downloads the currently filtered/searched list (capped at 5,000 rows) for further analysis outside the dashboard.