You cannot renew what you cannot see. Discovery is where every NextPKI engagement starts.
No single source sees everything. We run all four and deduplicate the overlap, so a missing certificate has to be missing from your network, your cloud, your CA portals, and the public logs at the same time. It usually is not.
A small agent that walks the CIDR ranges you configure, performs TLS handshakes against open ports, and reports the certificates it finds. Runs in your network, talks only to your NextPKI tenant over mutual TLS.
Read-only API integrations with the cloud certificate stores you already use. We pull what is issued, what is bound to load balancers, and what is expiring on your behalf.
Every certificate you have ever ordered from a public CA shows up in the CA portal. We pull that inventory through the CA APIs so old orders, expiring orders, and orders someone else placed on the same account are all visible.
Every TLS certificate from a publicly trusted CA lands in a CT log. We watch the logs continuously for issuance against your domains, so a certificate someone provisioned without telling you still shows up within minutes.
Enough to reason about it, never the private key. Every cert in the inventory carries the public-side metadata plus where in your estate it was actually seen.
{ "common_name": "api.acme.eu", "sans": ["api.acme.eu", "v2.api.acme.eu"], "issuer": "Let's Encrypt R10", "not_after": "2026-06-08T07:14:22Z", "days_left": 14, "key": "ECDSA P-256", "sig_alg": "ecdsa-with-SHA256", "seen_at": [ { "source": "sensor", "endpoint": "10.4.7.12:443" }, { "source": "aws-acm", "arn": "...alb-prod" }, { "source": "ct-log", "log": "Argon 2026" } ] }
The sensor sits inside your network, so it is the part of NextPKI your security team will scrutinise hardest. We optimised the design accordingly.
Source is public. Your security team can read it, fork it, audit it, run their own build, and verify the binary they actually deploy.
The sensor never holds, parses, or transmits a private key. It opens TCP connections, completes the TLS handshake, and inspects the public side. That is all.
The sensor opens an outbound mutual-TLS connection to NextPKI. No inbound ports. Bootstrap is a one-shot token, scoped to a single tenant.
Up to 25 000 endpoints. Inventory delivered as CSV plus audit report. Yours to keep, no obligation.
