As a content creator for vcdstool.com and an automotive repair expert familiar with diagnostic processes, I understand the importance of precise and reliable tools. Just as we use scan tools to diagnose vehicle issues, a certificate tool scan is crucial for identifying vulnerabilities within your network’s SSL/TLS certificates. This guide will walk you through the essential steps to configure your certificate tool scan effectively, ensuring comprehensive coverage and accurate results.
When setting up a new scan in your certificate tool, the initial configuration is key to obtaining meaningful insights. Let’s break down each step to ensure you’re optimizing your scan for the best possible outcome.
-
Naming Your Scan for Easy Identification
The first step is to give your scan a descriptive name. This might seem trivial, but clear naming conventions become invaluable when you’re managing multiple scans. A well-chosen name allows you to quickly identify and differentiate between scans, especially when analyzing historical data or comparing results from different configurations. For instance, instead of “Scan 1,” consider names like “Weekly External Certificate Scan” or “Internal Server Cert Check – SNI Enabled.”
-
Selecting the Appropriate Division
Next, you’ll need to choose the division associated with the sensor you intend to use for the scan. Divisions are organizational units within your account that help manage sensors. During the sensor installation process, each sensor is assigned to a specific division. Consequently, when configuring a scan, you will only see and be able to select sensors that belong to the division you’ve chosen.
Alt text: Screenshot showing the division selection dropdown menu in a certificate scanning tool interface. The dropdown is open, displaying a list of divisions such as ‘Main Office’, ‘Branch 1’, ‘Data Center’, and ‘Cloud Environment’. The currently selected division is highlighted.
Note: If your account isn’t structured using divisions, you will see your organization’s name listed instead.
-
Specifying Ports for Comprehensive Scanning
Defining the ports for your scan is crucial for thorough certificate discovery. This step dictates which network ports the tool will probe to find SSL/TLS certificates. You have a couple of options here:
- All: Choosing “All” instructs the scan to include every port within a specified range. This is useful for a broad sweep to uncover certificates on non-standard ports.
- Default: Selecting “Default” automatically includes a list of ports commonly associated with SSL/TLS certificates. This default list typically includes ports like 443 (HTTPS), 389 (LDAPS), 636 (LDAPS), 22 (SSH), 143 (IMAP), 110 (POP3), 465 (SMTPS), 8443 (alternative HTTPS), and 3389 (RDP). Using the default option provides a balance between comprehensive scanning and efficiency.
-
Enabling Server Name Indication (SNI) Scanning (Optional)
Server Name Indication (SNI) is a technology that allows multiple domains to be served from a single IP address. If your environment utilizes SNI, enabling SNI scanning is essential. By enabling this option, the certificate tool scan will probe servers for certificates associated with different domain names hosted on the same IP. Keep in mind that SNI scanning may have limitations, such as a maximum of 10 ports per server in some configurations.
Note: A scan performed with SNI enabled might not always include IP address information as part of the scan results, focusing instead on domain-specific certificate details.
-
Selecting the Appropriate Sensor
Choose the specific sensor that will perform the certificate tool scan. As mentioned earlier, you will only be presented with sensors that are assigned to the division you selected in step 2. The choice of sensor can depend on factors like network location and access permissions.
Note: Similar to division selection, if you are not using divisions, you will see your organization’s name listed, representing the available sensors under your organizational account.
-
Defining the Scan Target: IP Addresses and FQDNs
This is where you specify the targets for your certificate tool scan. You have options to include or exclude specific IP addresses and Fully Qualified Domain Names (FQDNs):
-
Include FQDNs and IP addresses: Enter the FQDNs (e.g.,
www.example.com) and IP addresses (e.g.,192.168.1.1) you want to scan. You can include single IP addresses, ranges of IP addresses (e.g.,192.168.1.1-192.168.1.255), or IP ranges in CIDR format (e.g.,192.168.1.0/24). Click Include after entering each target. -
Exclude FQDNs and IP addresses: If you need to exclude specific addresses from a broader range, enter them here. This is useful for skipping known test servers or internal networks. You can exclude single IPs, ranges, or CIDR blocks, similar to the include function. Click Exclude after entering each exclusion.
-
-
Managing Subdomains for Granular Control
For domain-based scanning, you have flexible options to manage subdomains:
- Include all subdomains: This option adds all discovered subdomains of a specified domain to your scan.
- Exclude all subdomains: This option prevents any subdomains of a domain from being scanned.
- Add subdomains or Edit subdomains: These links allow you to selectively choose specific subdomains to include or exclude from the scan. You will be presented with a list of available subdomains, allowing for granular control over your scan scope.
- Delete: Use the Delete action to remove a specific IP/FQDN entry from your scan list entirely.
Alt text: Screenshot of a table displaying domain and subdomain management options in a certificate scanning tool. Columns include ‘Domain’, ‘Actions’, and options in the ‘Actions’ column are ‘Include all subdomains’, ‘Exclude all subdomains’, ‘Add subdomains’, ‘Edit subdomains’, and ‘Delete’.
Note on using subdomains:
- You can add subdomains at any level to your scan.
- The system typically displays only subdomains that are one level below the main domain for easier management.
- Only publicly listed subdomains are available for selection. This means subdomains that are discoverable via public DNS servers or Certificate Transparency (CT) logs can be included in your scan.
-
Finalizing Scan Configuration
Once you have configured all the necessary settings, including naming, division, ports, SNI, sensor, and scan targets (IPs, FQDNs, and subdomains), review your configuration to ensure accuracy. When you are satisfied, click Next or a similar button to proceed to the next stage of setting up your certificate tool scan, which usually involves scheduling and initiating the scan.
By meticulously following these steps, you can configure your certificate tool scan to effectively identify and manage SSL/TLS certificates across your network, enhancing your overall security posture. Just like a precise diagnostic scan in auto repair pinpoints vehicle problems, a well-configured certificate scan provides critical insights into your digital infrastructure.
