Skip to content
Docs sslbrain sslbrain.com

Step 4 of 8

4. Find the certificates you already have

Copy link to the page “4. Find the certificates you already have”

A network scan shows which servers answer with TLS and when their certificates expire. This step is optional.

You can skip this step

Copy link to the section “You can skip this step”

Nothing in the following steps depends on the scan. Go straight to step 5, Connect servers. A service agent finds the certificates on its server by itself when it reports in.

Scan a network

Copy link to the section “Scan a network”

The scan runs from the appliance, so the appliance must be able to reach the addresses.

  1. Open Find servers › Discovery and click New network scan.

  2. Enter the addresses under IP ranges, one per line: IP addresses, CIDR ranges such as 192.168.1.0/24, or address ranges.

  3. Leave Ports as it is. The default ports are then scanned.

  4. Click Start scan.

The servers are listed under Discovered servers. Click Details on a server to see the issuer, expiry date and grade for each TLS port. From there you can:

  • click Enable, so the appliance scans the server’s TLS ports again every night at 04:00.
  • click Manage, so the server is created in sslbrain. A Windows server then gets a service agent (step 5).

Check a single address

Copy link to the section “Check a single address”

  1. Open Find servers › TLS scanning and click New scan.

  2. Enter the hostname and port, for example intranet.example.com and 443, and start the scan.

The result shows the certificate and a Grade for the TLS configuration.

Scan on a schedule

Copy link to the section “Scan on a schedule”

Scheduled scanning is off until you switch it on. Only an administrator can save.

  1. Open Find servers › Settings.

  2. Switch on Aktiver discovery.

  3. Choose Scanfrekvens: Hver time (hourly), Dagligt (daily) or Ugentligt (weekly).

  4. Enter CIDR ranges under IP-intervaller, separated by commas, for example 10.0.0.0/24, 192.168.1.0/24.

  5. Click Save settings.

The other fields are under Fields for scheduled scanning.

Certificates on the servers

Copy link to the section “Certificates on the servers”

Certificates › Found on servers shows valid certificates that sslbrain has not installed itself. They come from the server’s certificate store when a service agent reports in (Discovery on the server), from Windows CA, and from certificates you upload without a profile.

sslbrain does not renew the certificates on this list. If one of them should renew automatically, create a rule for the server (step 8).

Certificates that expired within the last 90 days are under Certificates › Expired. Certificates superseded by a newer one are under Certificates › Replaced.

Upload a certificate

Copy link to the section “Upload a certificate”

Upload a certificate that neither the scan nor an agent can reach, so you can keep an eye on its expiry date.

  1. Open Certificates and click Upload certificate.

  2. Choose the file under Certificate file: PEM, CRT, CER, DER, PFX, P12 or JKS, up to 5 MB.

  3. Add the private key, the chain and the password for a PFX, P12 or JKS file, if you have them.

  4. Click Upload certificate.

Without a private key, only the expiry date is monitored. With the key, the certificate can be installed on a server. An uploaded certificate is not renewed, and an upload does not install anything.

If it fails

Copy link to the section “If it fails”
  • The scan finds no servers: the appliance must reach the scanned addresses through the firewall. See The server cannot be reached.
  • TLS scanning gives no result: the appliance must be able to resolve the name and reach the port.
  • The scheduled scan does not run: Aktiver discovery must be switched on, and IP-intervaller must not be empty.
  • Found on servers is empty: the list fills up once a service agent has reported in. See step 5.

Ports scanned by default

Copy link to the section “Ports scanned by default”

The appliance scans the 24 ports below and the ports that installed agent packages declare:

22, 25, 110, 135, 143, 389, 443, 445, 465, 587, 636, 993, 995,
1433, 3306, 3389, 5001, 5432, 5985, 5986, 8006, 8080, 8443, 9090

Tick OS detection (no TLS) to only guess the operating system, without reading certificates.

Fields for scheduled scanning

Copy link to the section “Fields for scheduled scanning”
FieldDefaultWhat it does
PorteemptyEmpty means the default ports, whatever the help text below the field mentions.
Ekstra TCP-porteemptyPorts that are only checked for being open.
Ekstra direkte TLS-porteemptyPorts where the appliance also reads the certificate.
Opbevaringstid (dage)90Scans, and discovered servers that have not been enabled, are deleted after this many days.
TCP probe threads3How many connections the scan attempts at the same time.
Delay mellem batches (ms)0A pause between each batch of connections, so the network carries less load.