Certificate scanner - find TLS certificates on your internal network

The Certificate scanner sweeps hosts, CIDR networks and address ranges on any ports, completes a TLS handshake wherever something answers, and inventories every certificate it finds: subject, names, issuer, expiry, key, trust and protocol. It runs from your machine, so it reaches what a cloud scanner cannot - private networks, internal host names, LDAPS, RDP and mail servers behind the firewall. Nothing is uploaded.

Use it to find certificates that are about to expire, self-signed or untrusted certificates, name mismatches and old TLS versions before they cause an outage. On the command line it is actk scan, for scheduled scans.

The page shows its stages - Configure, Scan, Review results and Export - without becoming a wizard.

Configure a scanCopy Anchor Link

Targets - addresses, CIDR networks (up to /16), ranges or host names, separated by commas or new lines:

10.0.0.0/24
10.0.1.10-50
192.168.10.5
srv01.corp.local

This computer's networks are offered as one-click targets.

Ports - single ports and ranges, e.g. 443, 8443, 8000-8100, or a preset:

Server name (SNI) - optional, for IP targets. Without it, a server that hosts several sites may present a default certificate, and the name check runs against the IP address.

Options

Before you start, the page shows how many hosts, ports and probes the scan covers and how long it takes. The estimate comes from the connect timeout: unused addresses each wait it out, in batches of the parallel connections. Settings shows the duration for a /24 on two ports with your values. While the scan runs, the time left is shown, and Stop scan ends it.

STARTTLS and RDPCopy Anchor Link

Scan limitsCopy Anchor Link

A scan covers at most 65,536 addresses and 262,144 host/port probes, so a typo such as a /8 fails before it starts instead of running for days.

Review the resultsCopy Anchor Link

Endpoints appear as they answer. The counters above the table show the TLS endpoints, ports open without TLS or unreadable, certificates that are expired, that expire within 30 days, and that are untrusted or self-signed.

• Filters: All, Expired, ≤ 30 days, Untrusted, Self-signed, Name mismatch, No TLS / errors - plus a search over host, name and issuer.
• Columns: Status (always a word next to the colour), Endpoint, Subject, Issuer, Expires and Protocol. Click a column header to sort.
• Details of an endpoint: validity and days left, key, connection (address, protocol, cipher), trust, whether the name matches, serial number and the chain the server presented.
• Copy PEM, or Save as … .cer (DER), .crt / .pem or the presented chain - what a server presents is public, so saving it is safe.
• Run security scan grades that endpoint in the Security scan.

How trust is decidedCopy Anchor Link

Handshakes accept any certificate, so an expired or untrusted chain is still reported on. Trust is evaluated afterwards against:

• the Mozilla root program, bundled with the toolkit (always on);
• the Windows certificate store of this computer, which includes an internal CA rolled out by group policy (on by default, switchable in Settings);
• an optional PEM file with additional roots (Settings > Trusted certificate authorities).

Servers too old for a modern TLS library still appear: up to TLS 1.2 the certificate is sent in the clear, and the toolkit reads it from a hand-built handshake.

Export the inventoryCopy Anchor Link

Export CSV writes one row per endpoint with these columns:

host, address, port, transport, status, protocol, cipher, subject_cn, sans, issuer_cn,
not_before, not_after, days_until_expiry, key_type, key_size_bits, signature_algorithm,
self_signed, trusted_chain, hostname_match, serial, fingerprint_sha256, error

Export JSON writes the full result, including each presented chain, in the versioned aethercert.toolkit.cert-scan/v1 format - see Reports. Exports contain public certificates and network locations, never key material - but internal host names and addresses are sensitive, so treat the files accordingly.

Scan without the desktopCopy Anchor Link

actk scan 10.0.0.0/24 10.0.1.10-50 srv01.corp.local -p 443,636,3389,8443 `
  --csv inventory.csv --json inventory.json

Run it from Task Scheduler for a weekly inventory. All options are in the CLI reference.