Create a serverless schedule for Microsoft CA discovery
Create a serverless discovery schedule to discover Microsoft Certificate Authority (CA) certificates.
Before you begin
- Verify that the CA process is up and running on the host machine.
- Verify that a Windows host was discovered during a previous horizontal discovery. For more information, see Windows discovery.
Role required: discovery_admin
Procedure
Navigate to All > Discovery > Discovery Schedules.
Create the discovery schedule record.
Select New.
On the form, fill in the fields.
| Field | Description |
|---|---|
| Name | Unique name for this discovery schedule. For example: Discover MS CA. |
| Discover | Scan type, which should be Certificates. |
| Certificate Discovery Type | Certificate type, which should be CA Trust Discovery. |
| MID server | Name of the MID Server to use for this schedule. |
| Active | Enables this schedule for discovery. |
3. Select **Submit**.
Create the execution pattern.
In the Discovery Schedules page, select the record you created.
In the Serverless Execution Patterns tab, select New.
Discovery uses each execution pattern to discover up to 20,000 certificates. For deployments using more than 20,000 certificates, create several execution patterns.
On the form, fill in the fields.
| Field | Description |
|---|---|
| Name | Descriptive name for this record. For example: Discover MS CA. |
| Pattern | Pattern to be used for this schedule, which should be the Microsoft CA - Certificate Management pattern. |
| Proxy Host | CI name of the Windows host running the Microsoft CA Service, discovered in a previous discovery and populated in the CMDB. |
| Active | Option to enable this schedule for discovery. |
4. Select **Submit**.
Set the pattern launcher parameters.
In the Discovery Pattern Launcher Parameters tab, select the record you created.
On the form, fill in the fields.
| Parameter | Description |
|---|---|
| template\_list | Determines whether to search on all the request IDs or a template ID to discover certificates. Possible values are all or the template ID number.- all: Restricts discovery to all certificate request IDs in ascending order. The request IDs are limited either by the default execution pattern limitation of 20,000 or values set in start_offset or limit.
For example: 1.2.3.4,5.6.7.8,9.10.11.12 |
| start\_offset | This optional parameter specifies the number of the certificate from which to start discovery and is relevant only when template_list is set to all and for deployments with over 20,000 certificates. If you create multiple serverless execution patterns for deployments with over 20,000 certificates, use 1 for the first execution, 20001 for the second, and so on. If this parameter remains empty, start_offset defaults to 1. |
| limit | This optional parameter limits the certificate discovery to the specified value and is relevant only when template_list is set to all. If the parameter remains empty, the limit defaults to 20,000 certificates. |
| ip | IP of the server on which the CA process \(certsrv\) is running. |
| discover\_SAN\_for\_template | When set to true, this optional parameter enables the discovery of the subject alternative name (SAN) of the certificates when a template ID is provided in the template_list parameter.This parameter executes separate commands for each certificate within the template ID, which could impact performance. When searching on all request IDs, SAN is automatically discovered, so this parameter should remain empty. |
3. Select **Submit**.
What to do next
Either execute discovery immediately by selecting Discover now or wait until the predefined schedule triggers the discovery.
Parent Topic:Microsoft Certificate Authority (CA) certificates discovery
Related topics