Skip to main content
Linux Server discovery finds the certificates stored in files and keystores on your Linux servers, such as the certificates your web servers and Java applications load from disk. Scans reach each server through an SSH connection that uses an Infisical Gateway. Private keys in these files aren’t imported.

​
Prerequisites

The gateway doesn’t verify the SSH host key of the servers it connects to. Only use SSH connections to servers on networks you trust.

​
Supported files

Each certificate file becomes an installation named after the server’s hostname and the file path, for example web-01:/etc/nginx/ssl/fullchain.pem. A leaf certificate is imported with the CA certificates in the same file. Files that hold only CA certificates, such as trust bundles, are skipped unless you turn on Include trust stores and CA bundles. Scans only open files with these extensions: .pem, .crt, .cer, .cert, .der, .p7b, .p7c, .pfx, .p12, .jks, .keystore, .truststore, .jceks, .ks, and files named cacerts.

​
Give the SSH user read access

Certificate files are often readable only by root. Give the SSH user read access through a group or ACL where you can, and use sudo only with a dedicated scan account.
Add the SSH user to a group that can read the folders, or grant read access with an ACL:
The second command makes files created later in the folder readable too.
If a folder still can’t be read, the scan completes and the job shows which folders were skipped.

​
Create a Linux Server discovery job

1
In Certificate Manager, go to Discovery and select Add Job, then select Linux Server.
2
In SSH Connections, select the connection for each server to scan.
3
In Search Folders, add the folders to search. In Skip Folders, add any folders to leave out. /proc, /sys, and /dev are always skipped.
4
Set the options:
  • Folder Depth: how many levels below each search folder to search (defaults to 8)
  • Include trust stores and CA bundles: also import CA certificates from files that hold no leaf certificate
Files larger than 512 KB are skipped and listed in the scan results. To raise that limit, set maxFileSizeKb on the job through the API.
5
Enter a Name and an optional Description. To run the job on a schedule, turn on Scan on a Schedule and pick a Scan Interval.
6
Review the job and select Create Job.
7
Open the job and select Trigger Scan, or wait for the next scheduled scan.

​
Keystores that need a password

If a PKCS#12 file can’t be opened without a password, its installation is marked Locked and no certificates are read from it. To read it:
1
Go to Discovery > Installations and open the locked installation.
2
Select Set Password, enter the keystore password, and select Save.
The file is scanned again right away, and later scans use the same password. If the password is wrong, the installation is marked Password Failed, and you can select Change Password to try again. To set the password through the API, call the endpoint that updates an installation with keystorePassword. Send null to remove a saved password.

​
FAQ

The scan completed, but some files or folders couldn’t be read, or the scan stopped early. The job lists what happened. For folders or files the SSH user can’t open, give the SSH user read access. For files over the 512 KB size limit, raise maxFileSizeKb on the job through the API. If the scan stopped after 5,000 files, narrow the search folders or add skip folders.

​
What’s next?

Discovery overview

Learn how installations and certificate matching work.

Network

Scan TLS endpoints across IP ranges and domains.