Skip to main content
Windows Server discovery finds the certificates in the Local Machine certificate store on your Windows servers, such as the certificates that IIS, Remote Desktop, and SQL Server use. Scans reach each server through a Windows (WinRM) connection that uses an Infisical Gateway. Private keys aren’t read or imported.

​
Prerequisites

  • A gateway running the latest version, deployed where it can reach your servers over WinRM
  • A Windows (WinRM) connection for each server, configured to use a gateway or a gateway pool
  • A Windows account for the connection that can open a WinRM session on each server, such as a member of the Remote Management Users group

​
Certificate stores

Each certificate becomes an installation named after the server’s hostname and the certificate’s store path, for example web-01:Cert:\LocalMachine\My\3A1F.... You choose which stores to scan: A leaf certificate is imported with its chain, built from the intermediate and root certificates on the server. CA certificates found on their own are skipped unless you turn on Include CA Certificates. The two certification authority stores hold only CA certificates, so you can select them only when that setting is on. If the connection’s account can’t open a store, the scan completes and the job lists the stores it couldn’t open.

​
Create a Windows Server discovery job

1
In Certificate Manager, go to Discovery and select Add Job, then select Windows Server.
2
In Windows (WinRM) Connections, select the connection for each server to scan.
3
Under Server Certificate Stores, select the stores to scan. To also import CA certificates found on their own, turn on Include CA Certificates under CA Certificate Stores, then select the CA stores to scan.
4
Enter a Name and an optional Description. To run the job on a schedule, turn on Scan on a Schedule and pick a Scan Interval.
5
Review the job and select Create Job.
6
Open the job and select Trigger Scan, or wait for the next scheduled scan.

​
FAQ

The scan completed, but some stores or certificates couldn’t be read, or the scan stopped early. The job lists what happened. If a store couldn’t be opened, check that the connection’s account can read it on the server. If the scan stopped after 5,000 certificates, ran out of time, or found more certificates than one scan can return, select fewer stores.
No. Windows Server discovery only reads the certificate store.

​
What’s next?

Discovery overview

Learn how installations and certificate matching work.

Linux Server

Find certificate files and keystores on Linux servers.