Strata Copilot
    Next-Gen Trust Security
    : Discover certificates on machines
    Focus
    Focus
    1. Home
    2. Next‑Gen Trust Security
    3. Next-Gen Trust Security
    4. Next-Gen Trust Security overview
    5. Discovery overview
    6. Discover certificates on machines

    Next-Gen Trust Security

    Discover certificates on machines

    Table of Contents

    Discover certificates on machines

    Next-Gen Trust Security supports machine-based discovery, allowing you to identify and track certificates that are already deployed to machines in your environment. Discovery helps you understand which certificates exist on a machine, identify changes over time, and manage those certificates appropriately.
    Discovery is supported for the following machine types:
    • A10 Thunder ADC
    • Citrix ADC
    • Cloudflare
    • F5 BIG-IP LTM
    • Kemp LoadMaster
    • Microsoft IIS
    • Microsoft Azure Key Vault
    • Palo Alto Panorama
    • VMware NSX Advanced Load Balancer (AVI)
    Warning: Next-Gen Trust Security does not import certificates stored in PFX or PKCS#12-formatted keystores during discovery. These certificates are skipped automatically, and the discovery job continues without failure.

    Before you begin

    • The machine must already be created in Next-Gen Trust Security. If not, see Create a new machine.
    • The machine must be successfully connected. Use Test Access on the Access tab to verify connectivity.
    • The machine must show a Verified status on the Access tab.

    Run discovery on a machine

    1. Sign in to Next-Gen Trust Security.
    2. Click Insights > Machines.
    3. Select the machine you want to discover certificates on.
    4. Verify that required connection fields (such as address and credentials) are populated.
      Note: For Cloudflare machines, discovery does not include certificates associated with wildcard hostnames.
    5. Select the Discovery tab to configure discovery behavior.
    Available filters vary by machine type. If no filters are configured, discovery searches all supported locations for that machine.

    Machine-specific discovery filters

    F5 BIG-IP LTM

    • Resource types to discover – Virtual servers, monitors, or both.
    • Partitions – Comma-separated list of partition names. Leave blank to include all partitions.
    • Exclude expired certificates
    • Exclude inactive certificates
    • Discovery schedule

    Microsoft Azure Key Vault

    • Exclude disabled certificates
    • Exclude expired certificates
    • Discovery schedule

    Microsoft IIS

    • Certificate store – Personal, Web Hosting, or both.
    • Exclude expired certificates
    • Discovery schedule

    VMware NSX Advanced Load Balancer (AVI)

    • Tenants – Comma-separated list. Leave blank to include all tenants.
    • Exclude expired certificates
    • Exclude inactive certificates
    • Discovery schedule

    Cloudflare

    • Exclude expired certificates
    • Discovery schedule

    Citrix ADC

    • Resource types to discover – Virtual servers, monitors, or both.
    • Partitions – Comma-separated list. Leave blank to include all partitions.
    • Exclude expired certificates
    • Discovery schedule

    A10 Thunder ADC

    • Discovery runs in the default partition only.
    • Exclude expired certificates
    • Discovery schedule

    Kemp Virtual LoadMaster

    • Exclude expired certificates
    • Exclude certificates not in use by a virtual service
    • Discovery schedule
    1. Click Discover Now.
    2. A message below the machine name shows when discovery starts. Refresh the page to see completion status.
      Note: Discovery continues even if individual certificates encounter errors. If a discovery run encounters a large number of errors, it may stop early.
    3. Select the Discovery tab to review results, including:
      • Total discovered certificates
      • Newly discovered certificates
      • Installations created
      • Installations missing
      • Installations deleted
      • Execution time

    What do these results mean?

    • Total discovered – Certificates found during the current and previous discovery runs.
    • Newly discovered – Certificates found for the first time.
    • Installations created – New installation records created by discovery.
    • Installations missing – Installations previously found but not detected in the current run.
    • Installations deleted – Installations removed after remaining missing for several days.
    • Execution time – Duration of the discovery run.
    1. Select the Installations tab to view discovered certificate installations.
      Important: Installations that remain missing for multiple discovery runs are automatically removed.
      Important: For Cloudflare machines, discovery includes only custom certificates. Universal and backup certificates are not discovered because they are managed directly by Cloudflare.

    Set up a machine discovery schedule

    1. In the Next-Gen Trust Security toolbar, click Installations and select Machines.
    2. Select the machine you want to configure.
    3. Click the Discovery tab.
    4. Configure discovery options such as certificate store and exclusion settings.
    5. Enable the Schedule toggle.
    6. Under Repeat every, select Daily, Weekly, or Monthly, and choose a time.
    Note: Times are shown in UTC.

    © 2026 Palo Alto Networks, Inc. All rights reserved.