Discovery sources

A discovery source tells CertAutoPilot where to look for certificates that are not yet managed. All sources feed the same inventory.

Source types

Type	Input	Use case
CIDR / IP	IP ranges + ports	Known infrastructure — discover what's serving TLS in a subnet.
Hostname	FQDN list + ports	Services on cloud LBs / no stable IP.
DNS Zone Transfer (AXFR)	DNS resolvers + zones	SNI-routed frontends — enumerate every distinct cert behind one IP. See AXFR discovery.
Cloud DNS Provider	A provider connection + zones	You host DNS in the cloud (Cloudflare, Google Cloud DNS) and can't do AXFR — lists the zone's records through the provider API. See Cloud DNS discovery.
CT log monitor	Domains	Shadow IT — catch a cert issued outside your process. See CT monitoring.

note

CT log monitoring depends on an external aggregator (crt.sh), which is often rate-limited or unavailable, so it is hidden from the source-type picker by default. For SNI-routed internal infrastructure, prefer AXFR — it is authoritative and needs no external service.

CIDR / IP scan

1. Discovery → Sources → New → type CIDR / IP.
2. Fields:
   • Records: 10.0.0.0/24, 10.0.0.1 — one CIDR or IP per row, each with its own ports.
   • Ports: default 443. Any TLS-speaking port works (8443, LDAPS 636, IMAPS 993, SMTPS 465).
   • Allow Public IP Scan: off by default — only private (RFC1918) ranges are scanned. Turn on to scan public IPs you're authorized to assess.
   • Deep SNI Discovery + SNI candidate budget: see SNI-aware discovery below.
   • DNS lookup timeout / pool deadline: per-source DNS tuning, see DNS resolvers.
   • Schedule: either an interval (every N hours, min 24) or a day+time recurrence (selected weekdays at a fixed HH:mm in a timezone — for off-peak/night scans). Editable later from the source detail page.
   • Timeout per host / Max targets: standard scan controls.
   • Scan time limit (crawl_deadline_seconds; entered in the form in minutes, default 30 min, range 1–240) — applies to every network source type, not just CIDR, and stays editable later from the source detail page: see Execution model below.
3. Save. A live estimate shows the base target count (≈ IPs × ports); deep-SNI expansion is adaptive on top of that.

Hostname scan

Type Hostname. Records are FQDNs (app.example.com) instead of CIDRs; each is probed with its own name as SNI. Useful for endpoints that don't sit in a CIDR you can enumerate.

Editing a source

Open a source and choose Edit (also on each row of the sources list). To keep discovery history consistent, the edit page lets you change everything except the scope — the set of things a source scans is fixed once created:

• Read-only (scope): the source type; a CIDR range or a hostname value; the AXFR resolver selection; the cloud DNS-provider connection; a CT-log's domains.
• Add-only: zones — on a source that already lists specific zones you can add another but not remove one (removing would make that zone's endpoints look "disappeared"). A source with no zone list scans every zone its resolver/connection covers; that all-zones setting can't be narrowed to a specific list on edit (that would drop the other zones' endpoints) — create a new source for a subset. Adding a zone to a cloud DNS-provider source widens what the shared DNS token reads, so it requires an org administrator (a plain ports/schedule edit does not).
• Editable: ports, the proxied-record mode of a cloud DNS-provider source (edge / origin / both), schedule and limits, concurrency, timeout, crawl deadline, max targets, cipher-scan mode, deep-SNI, DNS timeouts, name, description, status.

To change scope (a different CIDR range, a different connection, or to drop zones), create a new source instead — an in-place scope change would false-report the old scope's certificates as gone.

AXFR & CT sources

• DNS Zone Transfer (AXFR) — name-first discovery for SNI-routed infrastructure. Full setup (DNS-side config for Windows/CoreDNS/BIND, resolvers, security): AXFR discovery.
• CT log monitor — Certificate Transparency audit for domains you own: CT monitoring.

SNI-aware discovery (deep SNI)

A single IP:port behind an ingress / content switch / virtual-host LB can serve many certificates, selected by the SNI in the TLS handshake. An SNI-less scan sees at most one of them (often a default/placeholder cert, or fails outright when the server enforces SNI). With Deep SNI Discovery on (the default), a network scan probes each responsive IP with additional server names to surface the hidden certificates:

• SAN-snowball — server names mined from the SANs of certificates already retrieved on that IP.
• Reverse DNS (PTR) — the name(s) the IP reverse-resolves to.
• Cross-source candidate pool — hostnames known to the project (previously discovered SANs, managed-cert domains, tracked domains, CT observations) that forward-resolve into the scanned range.

Each candidate is fingerprint-deduplicated, so exploration terminates. The SNI candidate budget (default 25, max 200) caps probes per IP:port — when it's reached the run logs a warning (never a silent miss). For authoritative enumeration behind SNI routing, use an AXFR source instead of relying on the candidate pool.

Endpoints record how each was found — discovery_method (no SNI, SAN crawl, reverse DNS, candidate pool, hostname, zone transfer, cloud DNS) and the SNI used — and are flagged SNI required when the IP rejects SNI-less handshakes. A row born from a proxied cloud-DNS record also carries an Edge or Origin tag.

Cipher-suite enumeration

A plain scan records only the one cipher suite the server negotiates with the scanner's modern client — so a host that still accepts RC4/3DES/CBC but prefers AES-GCM to a modern client looks clean. Cipher Suite Enumeration actively probes which suites the server accepts (one pinned single-suite handshake per suite × TLS version) and flags the weak ones a downgrade-capable client could still negotiate.

Set the mode per source (network, hostname, and AXFR sources — not CT log):

• Off — no extra handshakes. Legacy sources created before this feature resolve to Off, so a re-scan stays cost-neutral.
• Vulnerable only (recommended) — probes just the risky suites (RC4, 3DES, legacy CBC, and static-RSA no-forward-secrecy). New sources default to this.
• Selected suites — pick exactly which suites to probe from the multi-select (risky ones are red-tagged).
• All (full inventory) — probes every suite the scanner can offer, including the strong AEAD+PFS ones, and records the complete accepted set on the endpoint (the raw cipher_scan.accepted list, available via the API). The UI highlights only the weak/risky accepted suites (the strong ones raise no finding and aren't tagged), so use all when you want the full machine-readable inventory rather than extra UI detail.

Coverage is TLS 1.0–1.2. The scanner offers RC4, 3DES, CBC and static-RSA (no-PFS) suites and probes them at each in-scope TLS version (a suite accepted on TLS 1.0 is scored differently from one on TLS 1.2). NULL, EXPORT, raw DES and SSLv3 cannot be offered by the scanner and are out of scope — use a dedicated external scanner (e.g. sslyze, testssl.sh) for those. TLS 1.3 suites are always safe and are not enumerated.

Three outcomes per probe: accepted (handshake succeeded), rejected (the server refused the suite — a valid negative), and failed (timeout / transport / policy block — no verdict). A scan is complete only when every planned probe returned a verdict; the inventory and certificate detail mark an incomplete scan partial — X of Y probes so an empty result from a slow/tarpit host is never misread as "clean".

Enumeration honours the same SNI and outbound network policy as the primary probe, is bounded per endpoint by a wall-clock budget and a worker-wide concurrency ceiling, and feeds the endpoint's weak_cipher / no_pfs risk factors plus a dedicated weak_cipher_accepted endpoint finding.

Enumeration runs as a separate phase after the endpoint scan finishes, on its own concurrency pool — so it never slows down base discovery or starves other sources' scans, even on a large all-mode source. One baseline endpoint is enumerated per host:port.

Bounded per scan. To keep a large CIDR × All from launching millions of extra handshakes, each scan cipher-enumerates at most a fixed number of endpoints (5000); beyond that, endpoints are scanned normally but not cipher-probed. The run summary / job log always reports how many endpoints were enumerated, how many were skipped by this cap, and how many enumerations were incomplete (budget/transport) — the cap is never silent.

Stable across a scan, never stale after it. While cipher scanning stays enabled, an endpoint's stored enumeration remains visible for the whole scan instead of being cleared the moment the endpoint is re-probed — so a scan in progress can't make weak_cipher_accepted findings resolve and immediately reopen. Once the cipher pass has run, any result it did not re-verify this scan is dropped: an endpoint skipped by the per-scan cap or the pass deadline ends the scan with no cipher data (an honest "not checked"), never with an older verdict shown as current. Switching the source's cipher scanning off clears the stored results on its next scan.

DNS resolvers

Deep SNI's forward/reverse resolution and AXFR need a resolver that can see your internal / split-horizon names:

• Settings → General → Discovery DNS Resolvers — DNS servers the scanner uses to resolve candidate names and do reverse-DNS. Kept separate from the DV-propagation resolvers (which are usually public). Empty = the worker's system resolver (not the public DV resolvers, which can't see internal names).
• Per source: DNS lookup timeout (default 2 s) and DNS pool deadline (default 30 s) bound resolution time.

Security & policy

Network scans route every dial through the outbound network policy:

• Cloud-metadata (169.254.169.254, …), link-local, loopback, unspecified, and CGNAT addresses are always refused — even if listed explicitly or returned by a zone/PTR/candidate.
• CIDR sources pin egress to exactly the declared ranges; AXFR sources pin to the exact IPs resolved from the zone (DNS-rebinding safe).
• Public IPs are only scanned when Allow Public IP Scan is enabled.

Execution model

• A source is executed by a discovery_execute job on the worker queue.
• The scheduler sweeps active sources on their cadence; manual triggers bypass it.
• Results are written to the inventory as each endpoint is probed, not in one batch at the end — so the inventory fills in progressively during a long scan. A scan that is interrupted (worker shutdown) is marked cancelled and keeps what it had already recorded (its new-certificate / certificate-changed notifications are sent for that partial set); the remaining scope is covered by the next run.
• A scan with partial coverage is marked partial; in both the cancelled and partial cases the disappearance sweep is skipped so still-live endpoints aren't falsely removed. Coverage is treated as partial (sweep deferred) when: some AXFR zones failed, a database write failed, a previously-known endpoint was skipped this run due to error backoff (>3 consecutive failures in 24h), the SNI candidate budget was reached on a heavily virtual-hosted IP, the crawl deadline was reached, or the source was re-claimed by a newer run mid-scan (superseded). This is deliberately conservative: a genuinely-gone endpoint that is currently backed off stays as failed (its certificate retained) until a later complete run confirms the removal, rather than risking a false removal.
• Scan time limit (crawl_deadline_seconds; set in the source form and the source detail page in minutes — default 30 min, range 1–240, stored as seconds and clamped server-side to 60–14400) bounds the wall-clock time of the whole scan phase, for every network source type (CIDR, hostname, AXFR). Because results are persisted as they arrive, database write latency counts against this budget — on a very large source with a slow or remote MongoDB, raise the deadline (or split the source) if runs start finishing as partial with a "crawl deadline reached" warning in the job log.

What is stored

• discovered_certificates — subject, SANs, issuer, validity, SHA-256 fingerprint, key/signature algorithm, PQC classification (PQC readiness).
• discovered_endpoints — one row per (source, host, port, SNI) where the cert was seen, plus TLS version, cipher suite, negotiated key-exchange group (quantum-safe KEX classification), discovery method, the edge/origin role for a proxied cloud-DNS record, the observing source, and — when cipher enumeration is on — the accepted-suite scan result (accepted suites × version, plus rejected/failed counts and completeness).

The same IP:port:SNI found by two sources appears once per source; the inventory and cert detail show which source(s) observed each endpoint.

Re-runs and drift

A re-scan confirms existing entries or records a drift (fingerprint / issuer / key / SAN change) as a per-endpoint change with history — see findings.

Troubleshooting

Scan finds fewer certs than expected behind an ingress

The certs are SNI-routed and the candidate pool didn't have their names. Set up an AXFR source for authoritative enumeration, or add a Discovery DNS Resolver pointing at your internal DNS so candidate names resolve into the scanned range.

Scan is slow over WAN

Lower Timeout per host; unreachable hosts fail faster. Lower the SNI candidate budget to reduce handshakes per IP.

Scan result: network policy block

You targeted a refused address (metadata, link-local, loopback). Adjust the range, or point an AXFR/hostname source at reachable internal IPs.

See also

• AXFR discovery
• Inventory
• Findings
• Manage wizard (import as managed)