Expired certificates do not only live on your websites. They hide in printers, IP cameras, UPS cards, server BMCs, hypervisors, load balancers and the management interfaces of network gear, where no certificate manager ever looks. ConnectMyAssets reads the certificate of every TLS service its network scans find, flags expired, expiring and self-signed SSL certificates, and sends certificate expiry alerts before the end date, with the lead time you choose.
Request a demoA certificate that expires on a load balancer, an LDAPS server or a hypervisor breaks integrations, logins and backups overnight. Get the alert weeks before, with the host, the port and the end date, and renew in time.
Printers, cameras, UPS cards and BMCs ship with self-signed certificates that teach users to click through browser warnings. List them all, decide which ones to replace with certificates from your authority, and track progress.
Find every service still negotiating TLS 1.0 or 1.1, every short RSA key and every outdated signature algorithm with a rule written in a few conditions.
Flag every certificate that was not issued by your internal CA, and every wildcard certificate deployed where it should not be.
Show auditors a dated inventory of the certificates presented across the network and the alerts handled, a useful piece of evidence for NIS2 and ISO 27001 controls on cryptography.
No separate tool and no list of URLs to maintain: every TLS service the discovery finds on an audited port is read, stored and evaluated.
For every TLS port: subject, common name, alternative names, issuer, validity dates, self-signed or not, key type and size, signature algorithm and negotiated TLS version (1.0 to 1.3).
Every certificate past its end date raises an alert naming the host, the port and the date. The alert closes itself when the service presents a valid certificate again.
Choose how many days before the end date you want to be warned: 30 by default, from 1 to 730 days. Use different lead times per asset group, for example a longer one where renewals need a change window.
A certificate signed by its own key, not by a certificate authority, is flagged on every port where it is presented, so you know exactly which interfaces still run factory certificates.
Write your own conditions on the issuer, the subject and alternative names, the dates, the key, the signature algorithm, the TLS version, the service and the port: "issuer does not contain our root CA", "TLS 1.0 or 1.1", "wildcard on port 443".
Certificate checks cover the assets of your inventory and, if you choose, every host the discovery found, unmanaged devices included: printers, cameras, UPS, BMCs, appliances you have no credential for.
One alert per host and port in Soron: acknowledge, assign, resolve or mute it, add an exception with an end date, and notify the right team in-app, by e-mail, syslog or webhook.
Certificates are checked after every scan and again every five minutes: a certificate that crosses its end date between two scans is reported without waiting for the next one.
For security engineers: where the certificates come from, what is checked and what is not.
When a scan finds an audited port open, identification sends a TLS ClientHello and records the certificate the service presents and the negotiated version. HTTPS, LDAPS, IMAPS, WinRM over TLS and alternate ports such as 8443 or 9443 are all covered once enabled.
ConnectMyAssets records what is presented and reports facts: dates, issuer, self-signed. It makes no trust decision of its own, so a certificate from your private authority is never mistaken for an error.
Scans keep the server certificate of each port. To inspect the whole chain of a service, the Certificate tool of the host toolkit shows every certificate, its alternative names, key and signature algorithm.
A certificate expires with time alone. Detectors are evaluated after each scan, every five minutes and every day over their whole scope, and an alert reopens if an expired or self-signed certificate comes back.
Printer and industrial protocol ports are pre-identified and left out of audits by default. If you enable them, they never receive a ClientHello: identification only listens there. Scan rules decide, subnet by subnet, whether ports are audited at all.
Turn on 443, 8443, 636 and the other TLS ports you want audited.
Run or schedule a scan: every certificate presented is read and stored.
Choose the lead time, the scope and your custom certificate rules.
Renew the certificate: the alert closes at the next scan that sees the new one.
Prepare your project and define your scope.
Enable the TLS ports you want to audit (443, 8443, 636...) and run a network scan. ConnectMyAssets reads the certificate of every TLS service found and raises an alert for each expired one, with the host, the port and the end date. No list of URLs to maintain: every device that answers is covered.
A self-signed certificate is signed by its own key rather than by a certificate authority. Browsers cannot verify it, so users learn to accept warnings, which makes interception attacks easier to miss. ConnectMyAssets lists every self-signed certificate presented on your network so you can replace the ones that matter.
The lead time is yours to set, from 1 to 730 days before the end date, 30 days by default. Rules are defined per asset group, so different teams can work with different lead times.
Any IPv4 host your scans reach and any TCP port you audit: printers, IP cameras, UPS cards, server BMCs, hypervisors, load balancers, firewalls and switches, web and directory servers. Hosts that cannot be collected over SSH are covered too when you extend the rule to every host found.
No. A certificate is presented to anyone who opens a TLS connection, so ConnectMyAssets reads it from the network without an agent and without logging in.
Yes. The negotiated TLS version is recorded for every port, and a custom rule such as "TLS version is 1.0 or 1.1" raises an alert for each service concerned. The same rules work on key size and signature algorithm.
Scans record the server certificate of each port and report facts (dates, issuer, self-signed) without judging trust. The Certificate tool of the host toolkit displays the full chain of a service when you need to inspect it.
No. ConnectMyAssets audits and alerts; renewal stays with your PKI and your usual tools. Once a certificate is renewed, the next scan sees it and the alert closes by itself.
See what ConnectMyAssets can change for your team. On your infrastructure, with your requirements.
Request a demo