PKI Platform Integration

PKI scan runs independently of scan mode

-scan-pki is independent of the port-scan mode (-mode local or -mode remote). The ADCS LDAP query, Vault REST calls, and AWS PCA API calls run regardless of which mode the port scanner is in. This means you can use -mode remote -scan-pki to enumerate a PKI platform without running a full local scan:

# Fast PKI-only scan — skip local filesystem/process overhead
./build/certscanner -mode remote -host dc01.corp.com -ports 636,443 -scan-pki -insecure \
  -outputformat flatndjson -posttoelastic

This runs in seconds and emits only the PKI platform events — useful for validation and scheduled PKI-only inventory jobs.

Cross-scanner PKI certificate deduplication

PKI platform certificate IDs are anchored to the certificate, not to the scanner host. Scanning the same ADCS domain, Vault instance, or AWS PCA CA from two different machines produces the same event.id for the same certificate. Subsequent scans upsert the existing Elasticsearch document rather than creating duplicates.

This differs from filesystem certificate events, which include the observer host ID so the same file on two different endpoints produces distinct records.

PKI certificate quantum grade

Every PKI platform certificate event receives a quantum readiness grade using a cert-intrinsic 100-point formula. Two fields are emitted on all pki_certificate events:

An A grade is unreachable without a PQC key. RSA-2048 + SHA-256 + valid ≈ 57 → C. See Quantum Readiness Scoring — PKI Certificate Grade for the full formula and examples.

Certificate date field standard

All certificate event types emit a common set of date fields so Kibana / Splunk queries work consistently across TLS port-scan, filesystem, PKI, keystore, and app cert events:

Deprecated fields are retained for backwards compatibility with existing dashboards and will not be removed. Build new Kibana / Splunk queries using x509.not_after and certificate.not_after.

1. Domain-joined Windows host

On Windows, ADCS auto-detects via DNS SRV but GSSAPI/Kerberos is not available — store credentials once with -config-adcs-user, then scan with no extra flags:

# One-time credential setup
tychon-certscanner.exe -config -config-adcs-user "user@DOMAIN.COM" -config-adcs-pass "password"

# Subsequent scans (credentials loaded from config.enc)
tychon-certscanner.exe -scan-pki -outputformat flatndjson

2. Domain-joined Linux/macOS host (zero config)

On a domain-joined Linux or macOS host with an active Kerberos credential cache, ADCS auto-detects via DNS SRV and authenticates via GSSAPI — no credentials required:

./tychon-certscanner -scan-pki -outputformat flatndjson

3. Non-domain host with stored credentials

First, store credentials once (this writes to config.enc):

tychon-certscanner -config \
  -config-adcs-host dc01.corp.example.com \
  -config-adcs-user scanner@corp.example.com \
  -config-adcs-pass "secure-password"

Then scan — credentials loaded automatically:

tychon-certscanner -scan-pki -outputformat flatndjson

3. ADCS + filesystem scan + enrichment

Scan filesystem, port scan, enumerate ADCS CAs, and enrich all cert discoveries with PKI provenance:

tychon-certscanner \
  -scanfilesystem \
  -scan-pki \
  -outputformat flatndjson \
  -output /tmp/scan-results.ndjson

4. Internal CA cert for LDAP TLS verification

When the DC's TLS certificate is signed by an internal CA not in the OS trust store:

tychon-certscanner -scan-pki \
  -adcs-cacert /etc/ssl/certs/corp-root-ca.pem \
  -outputformat flatndjson