> ## Documentation Index > Fetch the complete documentation index at: https://infisical.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Linux Server > Find the certificates stored in files and keystores on your Linux servers. Linux Server discovery finds the certificates stored in files and keystores on your Linux servers, such as the certificates your web servers and Java applications load from disk. Scans reach each server through an [SSH connection](/docs/integrations/app-connections/ssh.md) that uses an [Infisical Gateway](/docs/documentation/platform/gateways/overview.md). Private keys in these files aren't imported. ## Prerequisites * A [gateway](/docs/documentation/platform/gateways/overview.md) running the latest version, deployed where it can reach your servers over SSH * An [SSH connection](/docs/integrations/app-connections/ssh.md) for each server, configured to use a gateway or a [gateway pool](/docs/documentation/platform/gateways/gateway-pools.md) * An SSH user that can read the folders you want to search (see [Give the SSH user read access](#give-the-ssh-user-read-access)) > [!WARNING] > > The gateway doesn't verify the SSH host key of the servers it connects to. Only use SSH connections to servers on networks you trust. ## Supported files Each certificate file becomes an installation named after the server's hostname and the file path, for example `web-01:/etc/nginx/ssl/fullchain.pem`. A leaf certificate is imported with the CA certificates in the same file. Files that hold only CA certificates, such as trust bundles, are skipped unless you turn on **Include trust stores and CA bundles**. Scans only open files with these extensions: `.pem`, `.crt`, `.cer`, `.cert`, `.der`, `.p7b`, `.p7c`, `.pfx`, `.p12`, `.jks`, `.keystore`, `.truststore`, `.jceks`, `.ks`, and files named `cacerts`. | Format | Notes | | - | - | | PEM | One or more certificates, including PEM-encoded PKCS#7 | | DER | A single certificate | | PKCS#7 | Certificate bundles | | PKCS#12 | Read without a password when possible, otherwise listed as locked | | JKS and JCEKS | Certificate entries are read without the keystore password | ## Give the SSH user read access Certificate files are often readable only by root. Give the SSH user read access through a group or ACL where you can, and use `sudo` only with a dedicated scan account. **Group or ACL** Add the SSH user to a group that can read the folders, or grant read access with an ACL: ```bash theme={"dark"} setfacl -R -m u::rX /etc/ssl/private setfacl -R -d -m u::rX /etc/ssl/private ``` The second command makes files created later in the folder readable too. **sudo** Allow the SSH user to run `find`, `readlink`, `head`, and `timeout` as root without a password. Add a file under `/etc/sudoers.d/`: ```bash theme={"dark"} ALL=(root) NOPASSWD: /usr/bin/find, /usr/bin/readlink, /usr/bin/head, /usr/bin/timeout ``` The gateway tries every folder and file as the SSH user first, and uses `sudo` only for the ones it can't read. It runs each command as root through `timeout`, so a command that runs too long is stopped on the server. If the rule doesn't allow `timeout`, the gateway doesn't use `sudo`, and the folders the SSH user can't read are listed as skipped. > [!WARNING] > > This rule lets the SSH user read any file on the server and run any command as root through `find` or `timeout`. Use it only for a dedicated scan account that nothing else can sign in with, and prefer a group or ACL. If a folder still can't be read, the scan completes and the job shows which folders were skipped. ## Create a Linux Server discovery job **Infisical UI** **Step 1** In **Certificate Manager**, go to **Discovery** and select **Add Job**, then select **Linux Server**. **Step 2** In **SSH Connections**, select the connection for each server to scan. **Step 3** In **Search Folders**, add the folders to search. In **Skip Folders**, add any folders to leave out. `/proc`, `/sys`, and `/dev` are always skipped. **Step 4** Set the options: * **Folder Depth**: how many levels below each search folder to search (defaults to 8) * **Include trust stores and CA bundles**: also import CA certificates from files that hold no leaf certificate Files larger than 512 KB are skipped and listed in the scan results. To raise that limit, set `maxFileSizeKb` on the job through the [API](/docs/api-reference/endpoints/pki-discovery/update.md). **Step 5** Enter a **Name** and an optional **Description**. To run the job on a schedule, turn on **Scan on a Schedule** and pick a **Scan Interval**. **Step 6** Review the job and select **Create Job**. **Step 7** Open the job and select **Trigger Scan**, or wait for the next scheduled scan. **API** To create the job, call [the endpoint that creates a discovery job](/docs/api-reference/endpoints/pki-discovery/create.md) with `discoveryType` set to `linux-server`. To start a scan, call [the endpoint that triggers a scan](/docs/api-reference/endpoints/pki-discovery/trigger-scan.md). ## Keystores that need a password If a PKCS#12 file can't be opened without a password, its installation is marked **Locked** and no certificates are read from it. To read it: **Step 1** Go to **Discovery** > **Installations** and open the locked installation. **Step 2** Select **Set Password**, enter the keystore password, and select **Save**. The file is scanned again right away, and later scans use the same password. If the password is wrong, the installation is marked **Password Failed**, and you can select **Change Password** to try again. To set the password through the API, call [the endpoint that updates an installation](/docs/api-reference/endpoints/pki-installations/update.md) with `keystorePassword`. Send `null` to remove a saved password. ## FAQ > **Why does the job show a warning after a scan?** > > The scan completed, but some files or folders couldn't be read, or the scan stopped early. The job lists what happened. For folders or files the SSH user can't open, [give the SSH user read access](#give-the-ssh-user-read-access). For files over the 512 KB size limit, raise `maxFileSizeKb` on the job through the [API](/docs/api-reference/endpoints/pki-discovery/update.md). If the scan stopped after 5,000 files, narrow the search folders or add skip folders. ## What's next? > **[Discovery overview](/docs/documentation/platform/pki/discovery/overview)** > > Learn how installations and certificate matching work. > **[Network](/docs/documentation/platform/pki/discovery/network.md)** > > Scan TLS endpoints across IP ranges and domains. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.