DigiCert ONE / CertCentral

Store both credentials and run first scan

# Have your secret manager provide TYCHON_DIGICERT_API_KEY and
# TYCHON_DIGICERT_ONE_API_KEY to this process. Set TYCHON_DIGICERT_ONE_URL
# for a non-default DigiCert ONE regional or private-cloud host.
./build/certscanner -config

# Read CertCentral orders and DigiCert ONE Private CAs
./build/certscanner -scan-pki -outputformat flatndjson \
  -output digicert_certs.ndjson

# Verify CA and scan-health events in the NDJSON output
grep '"event.action":"pki_ca_discovered"' digicert_certs.ndjson
grep '"event.action":"pki_scan_completed"' digicert_certs.ndjson

Send to Elasticsearch

# Configure both PKI and Elasticsearch credentials together in encrypted config.
./build/certscanner -scan-pki -posttoelastic

PKI scan with multiple connectors

# All configured connectors run together under -scan-pki
# (DigiCert + ADCS + Vault + Venafi — whichever have credentials in config.enc)
./build/certscanner -scan-pki -outputformat flatndjson -output all_pki.ndjson

Auth check returned HTTP 401

The API key was rejected. Common causes:

• CertCentral key was copied incorrectly — update TYCHON_DIGICERT_API_KEY in your secret manager and save the encrypted configuration again
• The API key was deactivated or deleted — generate a new one in CertCentral → Account → Account Access → API Keys
• The key is for a different CertCentral account or sub-account

Auth check returned HTTP 403

The API key is valid but lacks permission to view orders. The associated account must have at least View Orders permission in CertCentral role settings.

DigiCert ONE CA request returns HTTP 404

Verify the configured DigiCert ONE regional host and access to /certificate-authority/api/v1/ca. The scanner keeps any CertCentral order results but reports the DigiCert scan as partial or failed; HTTP 404 is not a successful empty CA inventory.

DigiCert ONE CA request returns HTTP 401 or 403

Check that TYCHON_DIGICERT_ONE_API_KEY is a current DigiCert ONE service-user token with permission to list Private CAs and download their certificates. The scanner reports authentication or permission failure in scan health; CertCentral orders remain available if that inventory succeeds.

Some certificates show key_size = 0 or quantum_risk = high (unknown key)

Older expired or revoked orders may no longer have certificate metadata attached in the DigiCert API. The per-order detail call returns no certificate object for these records. The connector defaults to a conservative risk = high assessment when key size is unknown. Active certificates always have full metadata.

Scan is slow / backing off on 429

CertCentral order requests use X-RateLimit-Reset handling. DigiCert ONE CA requests retry HTTP 429 at most twice. The ONE CA scan stops after two minutes and reports partial or failed health if the inventory remains incomplete.

CA inventory not configured

A CertCentral key does not authenticate to DigiCert ONE. Provide TYCHON_DIGICERT_ONE_API_KEY through the process environment or save it in config.enc. A CertCentral-only scan can still return orders, but its combined health status is partial when orders succeed.

Zero certificates returned

A scan is complete with zero certificates only when both configured inventories return successfully with no certificate records. Missing credentials, permission errors, request failures, or incomplete CA pages produce partial or failed health instead.