Skip to main content

​
What is Discovery?

Certificate Discovery scans your environment continuously and builds a complete inventory of every TLS certificate present — regardless of which CA issued it, whether your team knows about it, or whether it was provisioned through CertForge at all. Discovery sources run simultaneously:
  • Certificate Transparency (CT) logs — public logs that capture nearly every publicly-trusted TLS cert issued. CertForge watches CT logs for your domains and surfaces any cert as soon as it appears.
  • Active TLS scanning — CertForge connects to your registered hostnames and retrieves the certificate the server is actually serving. This catches certs that may not be in CT logs, including internally-issued certs.
  • CA connector imports — certs pulled directly from external CA APIs (DigiCert, Sectigo, internal CAs) via the CA Connector framework.

​
Governance Status

Every discovered certificate gets one of three governance statuses: Clicking Track on a discovered cert moves it to Tracked status. Clicking Dismiss marks it as a known false positive (excluded from reports).

​
Policy Mismatch Detection

When a discovered cert matches a Domain Trust Profile by domain pattern, CertForge evaluates it against that profile’s policy and flags any violations:
  • Wildcard not allowed — cert contains a wildcard SAN but the DTP prohibits wildcards
  • Validity too long — cert’s validity period exceeds the DTP’s configured maximum
  • EKU mismatch — cert contains an Extended Key Usage not permitted by the DTP
Violations appear as a red badge on the Discovery page. This gives your security team immediate visibility into out-of-policy certs already in production, without waiting for a manual audit.

​
Chrome Root Program EKU Enforcement

Chrome Root Program Policy v1.8 (aligned with CA/Browser Forum Baseline Requirements / RFC 5280) requires that publicly-trusted TLS certificates carry only serverAuth in the Extended Key Usage field. Certificates that also include clientAuth — or any other EKU — on a cert chaining to a publicly-trusted root will be treated as non-compliant and may be rejected by Chrome. This is not just a Google preference: the CA/Browser Forum Baseline Requirements, which all public CAs are contractually bound to, enforce the same requirement. Chrome’s policy formalizes the deadline and the enforcement mechanism. CertForge automatically detects affected certificates:
  • Every discovered certificate is parsed for its EKU values
  • Any publicly-trusted cert carrying both serverAuth and clientAuth is flagged with a ⚠ Non-compliant EKU badge in the Discovery view
  • The EKU Issues filter on the Discovery page surfaces all affected certs at once
  • The Alerts system fires a non_compliant_eku alert when violations exist, so your team is notified automatically

​
What to do

For each flagged cert, the remediation is to reissue it from your CA with only serverAuth in the EKU extension. If the cert is also used for client authentication, that use case must move to a separate certificate chaining to a non-public (private) root — Chrome’s policy applies only to publicly-trusted roots.
Use the EKU Issues filter in Discovery to export the full list of affected certificates and share it with your CA or internal PKI team.

​
Discovery Page

Navigate to Discovery in the sidebar. The page shows all discovered certs with filters for:
  • Source: CT log / TLS scan / CA connector
  • Governance status: Tracked / Untracked / Ungoverned
  • Expiry: Active / Expiring ≤30 days / Expired
  • Policy: Compliant / Policy mismatch
Each cert row shows the issuer, SANs, expiry date, discovery source, and any policy violations.

​
Dashboard KPIs

The Dashboard shows discovery metrics at a glance:
  • CA Inventory — count of certs imported via CA connectors
  • Tracked — count of explicitly governed discovered certs
  • Ungoverned — count of certs with no matching Trust Profile
See Dashboard for the full KPI reference.

​
Configuring Discovery Targets

Discovery runs automatically against domains registered in your Domain Trust Profiles. To add scan targets:
  1. Go to Admin → Domain Trust Profiles
  2. Open a profile and ensure domains are registered
  3. CertForge begins scanning those domains on the next discovery cycle
For CA connector-based discovery, see CA Connectors.