mirror of
https://github.com/hanzoai/kms.git
synced 2026-10-17 11:18:16 +00:00
zeekay
db49f40b8e
Public-facing docs, metadata, and branding: - README.md: remove fork attribution, rebrand intro - package.json: clean description - CONTRIBUTING.md, SECURITY.md: remove Infisical mentions - LLM.md: update image name, remove fork language - docs/docs.json: rebrand name, nav labels, social links, footer URLs - company/ handbook & docs: rebrand all Infisical mentions - .env.migration.example: use hanzokms credentials - flake.nix: update description, remove infisical package - .github/ISSUE_TEMPLATE/config.yml: fix broken ghcr.io URLs - docs/ (24 files): rebrand prose, mermaid diagrams, API URLs - docs/Dockerfile: update spec fetch URL Removed upstream assets: - img/infisical_github_repo.png, infisical_github_repo2.png - .github/images/star-infisical.gif - .github/images/.!35663!deploy-to-aws.png (corrupted empty) NOT changed (would break code/legal): - LICENSE (MIT copyright must stay) - backend/src/ee/LICENSE.md (upstream enterprise license) - backend/package.json (@infisical/* npm deps) - Dockerfiles (apt-get install infisical CLI) - env var names (INFISICAL_TOKEN, INF_APP_CONNECTION_*) - docs.json page paths (require file renames) - frontend/dist/locales (compiled translation keys)
80 lines
3.6 KiB
Plaintext
80 lines
3.6 KiB
Plaintext
---
|
|
title: "Network"
|
|
description: "Learn how to configure a Network discovery job to find certificates across your infrastructure."
|
|
---
|
|
|
|
Network discovery scans network endpoints over TLS to discover certificates served by hosts across IP ranges and domains. Optionally, you can use an [KMS Gateway](/documentation/platform/gateways/overview) to reach endpoints in private networks that are not accessible from the internet.
|
|
|
|
<Tabs>
|
|
<Tab title="KMS UI">
|
|
1. Navigate to your Certificate Management Project > **Discovery** and press **Add Job**.
|
|
|
|
|
|
2. Fill in the discovery job details and click **Create**.
|
|
|
|
|
|
- **Name**: A slug-friendly name for the discovery job (e.g., `prod-tls-scan`).
|
|
- **Description**: An optional description for the discovery job.
|
|
- **Targets**: A list of domains, IP addresses, or CIDR ranges to scan (e.g., `example.com`, `192.168.1.1`, `10.0.0.0/24`).
|
|
- **Ports**: The ports to scan for TLS certificates. Defaults to common TLS ports if not specified.
|
|
- **Gateway** (optional): The KMS Gateway to use for running the scan. Only required to reach endpoints in private networks.
|
|
- **Auto Scan**: Toggle to enable automatic periodic scanning. When enabled, select a scan interval (e.g., daily, weekly).
|
|
|
|
<Note>
|
|
At least one target (domain or IP) must be specified.
|
|
</Note>
|
|
|
|
3. Trigger a scan manually by pressing **Scan Now** on the discovery job's page, or wait for the next automatic scan if auto scan is enabled.
|
|
|
|
|
|
4. After a scan completes, view the results on the discovery job's detail page:
|
|
|
|
|
|
- **Installations**: The unique locations where certificates were found.
|
|
- **Certificates**: The certificates discovered at each installation, including details such as common name, issuer, and expiration date.
|
|
- **Scan History**: A log of all scans that have been run, including status and timestamps.
|
|
</Tab>
|
|
<Tab title="API">
|
|
To create a **Network** discovery job, make an API request to the [Create Discovery](/api-reference/endpoints/pki-discovery/create) API endpoint.
|
|
|
|
### Sample request
|
|
|
|
```bash Request
|
|
curl --request POST \
|
|
--url https://kms.hanzo.ai/api/v1/pki/discovery \
|
|
--header 'Authorization: Bearer <access-token>' \
|
|
--header 'Content-Type: application/json' \
|
|
--data '{
|
|
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
|
"name": "prod-tls-scan",
|
|
"description": "Scan production network for TLS certificates",
|
|
"type": "network-tls",
|
|
"gatewayId": "550e8400-e29b-41d4-a716-446655440000",
|
|
"isAutoScanEnabled": true,
|
|
"scanIntervalInDays": 1,
|
|
"targetConfig": {
|
|
"ipRanges": ["10.0.0.0/24", "192.168.1.1"],
|
|
"domains": ["example.com"],
|
|
"ports": "443, 8443"
|
|
}
|
|
}'
|
|
```
|
|
|
|
To trigger a scan, make a request to the [Trigger Scan](/api-reference/endpoints/pki-discovery/trigger-scan) endpoint:
|
|
|
|
```bash Request
|
|
curl --request POST \
|
|
--url https://kms.hanzo.ai/api/v1/pki/discovery/<discoveryId>/scan \
|
|
--header 'Authorization: Bearer <access-token>'
|
|
```
|
|
</Tab>
|
|
</Tabs>
|
|
|
|
## Limits
|
|
|
|
The following limits apply to Network discovery jobs:
|
|
- **Max individual IPs**: 256
|
|
- **Max domains**: 20
|
|
- **Max ports**: 5
|
|
- **Minimum CIDR prefix**: `/24` (256 hosts)
|