Enable system scans
You configure and manage system scans from the Discovery & automation tools > Agents page in DigiCert® Trust Lifecycle Manager.
Configure system scans to discover certificates from Windows operating system certificate stores and the file system. For password-protected key stores on the file system, use key store credentials to discover certificates. Assign business units and certificate assignment rules to discovered assets. Configure the scan to run immediately or at a scheduled time.
You can enable system scans for:
A single DigiCert agent.
Multiple selected agents in bulk.
A pre-configured agent group.
Avis
Trust Lifecycle Manager also has a global auto-scan setting to automatically run a one-time system scan each time you install and activate a new DigiCert agent. To learn more, see Enable automatic one-time system scans.
Before you begin
Make sure there is an active DigiCert agent on each host system to scan. See Prerequisites.
Set up a scan
Single agent
To enable system scans for a single DigiCert agent:
Select Discovery & automation tools > Agents from the Trust Lifecycle Manager main menu.
Select the agent for the host system you want to scan.
On the agent details page, open the System scans tab.
Select Configure system scan.
Configure the scan options in the sidebar that appears.
Select Save to finish and enable the scan for the current agent.
Multiple selected agents
To enable system scans for multiple DigiCert agents:
Select Discovery & automation tools > Agents from the Trust Lifecycle Manager main menu.
Select the checkboxes next to the agents for the host systems you want to scan.
Hover one of the selected agent names, open the Bulk actions dropdown next to it, and select System scan > Configure.
Configure the scan options in the sidebar that appears.
Select Save to finish and enable the scan for the selected agents.
Agent groups
To configure a system scan for a group of DigiCert agents, first configure the agent group. Refer to Agent groups for more details.
To enable system scans for all agents in an agent group:
Select Discovery & automation tools > Agents from the Trust Lifecycle Manager main menu.
In the More actions dropdown above the agents table, select the option to Configure system scan for agent groups.
Select one or more agent groups from the Agent groups dropdown in the sidebar that appears. The scan will be enabled for all agents in all agent groups you select.
Configure the general scan options in the sidebar.
Select Save to finish and enable the scan for the selected agent groups.
Scan options
General system scan options are the same regardless of whether you configure them for a single agent or multiple agents.
What to scan for
Select which cryptographic assets to look for, and where.
Operating system certificate store: Look for certificates in the OS truststore.
Windows (CAPI) scope: Select one or more Windows certificate locations to scan. For each selected location, select one or more certificate stores to include in the system scan.
The following Windows (CAPI) locations are available for selection:
Current user: If selected, the system scans the certificate stores for all active Windows user accounts on the computer.
Local machine: If selected, the system scans the certificate stores available to all users on the computer.
File system: Search the selected assets on the host filesystem.
Certificates, public, and private keys: Search for all certificate and key files.
Archive files and Keystores: Search for certificates and keys in archive files and keystores.
Avertissement
The more assets and locations you select, the longer the scan takes to complete.
Section: Key store credentials
Include password-protected key stores: Optionally, select this option to configure key store credentials for discovering certificates in password-protected key stores during a system scan.
The Key store credentials table lists the available saved key store credentials. Select one or more credentials to include in the system scan.
To add key store credentials:
Select Add credential.
Specify the following information:
Format: Select the key store format.
Key store location: Enter the path to the password-protected key store.
Password for certificate files: Enter the password required to access the key store.
Select Save credential. You can add multiple key store credentials.
Select one or more saved key store credentials to include in the system scan.
Note
System scans support the following password-protected key store formats:
JKS (
.jks)PFX (
.pfx)P12 (
.p12)
Assign and identify assets
Configure options to help manage the discovered assets in Trust Lifecycle Manager.
Business unit: (Optional) Assign discovered assets to a specific business unit. Administrators assigned to that business unit can manage the assets.
Certificate assignment rules: (Optional) Select assignment rules for automatically assigning metadata to the discovered certificates.
Schedule
Select options for when to run the scan.
Start now: Run a one-time scan starting now.
Schedule for later: Schedule the scan for a later date and/or set up recurring scans at the frequency you select.
Avis
The first time you run a scan, it looks for all the cryptographic assets you selected. Use recurring scans to run incremental updates and keep your Trust Lifecycle Manager inventory updated as new cryptographic assets get added to each host system.
View scan details
To verify the current scan options and see upcoming and past scans for an agent:
Select Discovery & automation tools > Agents from the Trust Lifecycle Manager main menu.
Select the agent for the host system you want to view scan details for.
On the agent details page, open the System scans tab.
Global system scan blocklist
Use the system scan blocklist settings to specify absolute paths of files, folders, or complete disk drives to exclude from system scanning for all Linux or Windows agents. To manage the blocklist:
From the Trust Lifecycle Manager main menu, select Account > Settings > System scan.
Select the Exclusion list tab.
To add paths to the blocklist:
Enter comma-separated absolute paths in the Paths window on the left. You can enter a mix of Windows and Linux paths.
Select the Add to blocklist button to add the paths you entered to the current blocklist.
To remove paths from the current blocklist on the right:
To remove a single path from the blocklist, open the actions (three dots) menu for it and select Delete.
To bulk remove multiple paths from the blocklist, use the checkboxes to select the applicable paths, then open the Bulk actions dropdown for one of them and select Delete.
To remove all paths from the blocklist, select the Remove all link above the blocklist table.
Select Save to apply the new settings. Paths in the saved blocklist will be skipped for all subsequent system scan runs by any DigiCert agent.
Usage notes:
Use the Reset function to reset the system scan blocklist to the default paths for Windows and Linux agents.
To download the current blocklist as a CSV file, select the Export link above it.
What’s next
Manage system scans to make changes to existing scans, such as editing, canceling, rescheduling, or suspending/resuming them.
When the scans finish running, view the scan results in Trust Lifecycle Manager to see the cryptographic assets and security issues discovered by your DigiCert agents.