Documentation › Using Steward IT Census
Certificates
Steward IT Census lists the certificates on your computers and devices, so you know what expires when, before a web site, VPN, printer or management card starts showing warnings.
Open Assets › Certificates for all of them, or the Certificates tab of an asset.
Where certificates come from#
| Source | What is read | Needs |
|---|---|---|
| Windows store | The computer's (LocalMachine) stores Personal, Web Hosting and Remote Desktop, plus certificates in other stores that have a private key. The long lists of trusted root and intermediate authorities are left out. | Census agent 0.40.0 or later, or a WinRM scan |
| Server file (Linux) | Let's Encrypt certificates (/etc/letsencrypt/live), the certificates named in nginx, Apache, Postfix and Dovecot configurations, Proxmox, Cockpit and Webmin certificates |
Census agent 0.40.0 or later, or an SSH scan (root or sudo to read every file) |
| System keychain (macOS) | Certificates in the System keychain (for example MDM and Wi-Fi certificates) | Census agent 0.40.0 or later |
| TLS port | The certificate a device presents on its TLS ports during a network scan: 443, 8443, 9443, 10000, 5001 (web interfaces of printers, NAS, firewalls, iLO/iDRAC), 636 (LDAPS), 5986 (WinRM over HTTPS) and 3389 (Remote Desktop). Works for devices nothing can log in to. | A network scan (also through remote scanners 0.40.0 or later) |
Only the certificate is read, never a private key. A TLS check is an ordinary connection that is closed after the certificate is received.
What you see#
For each certificate: the subject and its names, who issued it (or self-signed), when it expires (red within 30 days, amber within 90), where it was found, and under Details the purposes, certificate template, key, signature algorithm, serial number and thumbprint.
The Expiry filters on the left show what expires within 30 or 90 days and what has already expired. An expired certificate that is still installed can usually be deleted from the store.
Reports and alerts#
- Reports (category Certificates): Certificates expiring in the next 30 days, Expired certificates, All certificates and Weak certificates (RSA keys under 2048 bits, SHA-1 or MD5 signatures, and self-signed certificates on TLS ports, which browsers warn about).
- Alert Certificate expiring (Configuration › Alerts & scheduled reports): emails each certificate once, when it comes within the chosen number of days of expiry (30 by default). The first check sends the certificates already that close; certificates that expired more than 30 days ago are left out.
To have Census renew a server's certificates with Let's Encrypt and bind them, see Certificate renewal.