Discovery is the front door to TigerTrust. Before you can automate renewals or enforce policy you need to know every certificate that exists. Scans run continuously or on-demand, record what they find in a staging area, and only promote certificates into managed inventory when you explicitly import them.
Discovery

​
What it is

A scan is a unit of work targeting one or more scanner types. Results land as discovered certificates — not yet in your inventory. You review the results, select the certificates you want to manage, and import them. From that point they are renewed, alerted on, and policy-enforced.

​
When to use it

  • Run an initial discovery sweep when onboarding a new environment to see what certificates exist.
  • Schedule nightly scans of your production network to catch new certificates issued outside the approved process.
  • Scan Kubernetes secrets across all namespaces to inventory cluster TLS certificates.
  • Run a one-time cloud scan after adding a new AWS account to import its ACM certificates.

​
Scan types

Network scans

internal_ip, internal_dns — a field agent connects to hosts and CIDRs, does a TLS handshake on candidate ports, and pulls the presented certificate chain.

Cloud scans

ca_certs, public_websites — the cloud discovery service enumerates CT logs and public endpoints for your domains.

Filesystem scans

filesystem, cloud_vault — a field agent walks a path and identifies PEM, DER, PKCS#12, JKS, and Windows/macOS trust stores.

Kubernetes secret scans

k8s_secrets — a field agent lists kubernetes.io/tls secrets across namespaces and extracts each tls.crt.
Agent-scoped types (internal_ip, internal_dns, k8s_secrets, ssh_authorized_keys, ssh_pub_files, filesystem, cloud_vault) require an assigned field agent. Cloud-scoped types (ca_certs, public_websites) run from the control plane. A single scan can request multiple types in one call.

​
Set it up

1

Open Discovery

Go to Discovery > Scans and click New scan.
2

Name the scan and choose types

Enter a name, select one or more scan types, and enter the targets appropriate to each type (CIDRs, hostnames, namespaces, or paths).
3

Assign an agent (if needed)

For agent-scoped types, select the field agent that has access to the target network or filesystem.
4

Start the scan

Click Start. The scan transitions to running and TigerTrust dispatches tasks to the appropriate executors.
5

Review results

When the scan completes, click View results. You’ll see each discovered certificate with its parsed subject, SANs, expiry, and source (endpoint, port, secret name, or file path). Nothing is added to your managed inventory yet.
6

Import selected certificates

Check the certificates you want to manage and click Import. Imported certificates appear immediately in Certificates and become eligible for policy evaluation, renewal windows, and deployment automation.

​
Scheduled scans

Click Schedule on any scan to attach a cron expression (for example, 0 2 * * * for daily at 02:00 UTC). Scheduled scans re-run automatically on their cadence using the same configuration. You can pause a schedule without deleting the scan.
Import is idempotent by fingerprint — re-importing a certificate that is already in your inventory is a no-op. You can safely import the same results multiple times.
Filesystem and Kubernetes scans surface private key material when it is co-located with the certificate file. Only the public certificate and a key fingerprint are sent to TigerTrust — private key material stays on the agent host.

Infrastructure inventory

Hosts, cloud accounts, and agents — the targets that scans run against.

Cloud integrations

Onboard AWS, Azure, and GCP accounts for cloud-native certificate discovery.

Container scanning

Registry and Kubernetes-specific discovery targets.