Certificate, Keystore, and Outlook Archive Discovery
The scanner provides comprehensive filesystem scanning capabilities to discover cryptographic assets across your systems:
PEM, DER, CRT, CER, PKCS#12, CSRs, and private keys
Windows Cert Store, macOS Keychain, Java JKS, PKCS#12
Encrypted PST, OST, PAB files with S/MIME certificates
Certificate scanning discovers and analyzes cryptographic certificate files stored on the filesystem.
# Enable filesystem certificate scanning
./certscanner -mode local -scanfilesystem -output certificates.json
# Use with full scan (includes memory, keystores, etc.)
./certscanner -mode local -fullscan -output full-scan.json
| Format | Extensions | Description |
|---|---|---|
| PEM | .pem, .crt, .cert, .cer | Base64-encoded certificates and keys |
| DER | .der | Binary-encoded certificates |
| PKCS#12 | .p12, .pfx | Password-protected certificate bundles |
| CSR | .csr | Certificate signing requests |
| Private Keys | .key, .pem | RSA, ECDSA, Ed25519, Ed448, DSA keys |
Post-Quantum Cryptography Detection: The scanner automatically detects ML-DSA (Dilithium), ML-KEM (Kyber), SLH-DSA (SPHINCS+), and other PQC algorithms in certificates and private keys.
Keystore scanning automatically discovers OS-native keystores and file-based keystores (Java JKS, PKCS#12).
| Type | Extensions | Common Uses |
|---|---|---|
| Java JKS | .jks, .keystore | Java applications, Tomcat, WebLogic |
| PKCS#12 | .p12, .pfx | Cross-platform keystores, IIS, browsers |
| BKS | .bks | Android applications, BouncyCastle |
Automatic Discovery: Keystore detection is automatically enabled with -scanfilesystem flag. No additional configuration required.
Detect encrypted Outlook archive files that may contain S/MIME certificates and encrypted emails.
# Scan for Outlook archives
./certscanner -mode local -scanoutlookarchives -output outlook-archives.json
# Combined with filesystem scan
./certscanner -mode local -scanfilesystem -scanoutlookarchives -output combined-scan.json
| Extension | Type | Description |
|---|---|---|
| .pst | Personal Storage Table | Outlook data file containing emails, contacts, calendar |
| .ost | Offline Storage Table | Cached Exchange mailbox data |
| .pab | Personal Address Book | Outlook address book (legacy) |
Encryption Detection Only: The scanner identifies encrypted Outlook files but does not decrypt or extract contents. This helps identify potential repositories of S/MIME certificates and encrypted communications.
When -filesystem-paths is not specified, the scanner uses OS-specific default paths optimized for certificate discovery.
Override default paths with custom directories for targeted scanning. Use the -filesystem-paths flag with comma-separated paths.
./certscanner -mode local -scanfilesystem \
-filesystem-paths "/path1,/path2,/path3" \
-output custom-scan.json
certscanner-windows-amd64.exe -mode local -scanfilesystem `
-filesystem-paths "C:\inetpub,C:\Apache24" `
-output iis-apache-scan.json
./certscanner-linux-x64 -mode local -scanfilesystem \
-filesystem-paths "/etc/nginx,/etc/apache2,/etc/letsencrypt" \
-output webserver-certs.json
./certscanner-darwin-amd64 -mode local -scanfilesystem \
-filesystem-paths "/Users/johndoe/certs,/Users/johndoe/Documents" \
-output user-certs.json
./certscanner-linux-x64 -mode local -scanfilesystem \
-filesystem-paths "/var/lib/docker,/opt/kubernetes/pki" \
-output container-certs.json
Tip: When specifying custom paths, the scanner ONLY scans those directories. Default paths are not included. To combine custom and default paths, list all directories explicitly.
-cputhrottle)-cputhrottle high for low-impact-quickscan for initial discoveryThe scanner automatically skips these directories to improve performance:
node_modules, .git, .svn, .hg, __pycache__, .cache, .tmp, temp, Trash
Filesystem scan results are included in the main JSON output under dedicated sections:
{
"filesystem_scan_results": [
{
"source_file_path": "/etc/ssl/certs/server.crt",
"version": 3,
"serial_number": "1234567890",
"signature_algorithm": "MLDSA65",
"subject": {
"common_name": "example.com",
"organization": ["Example Corp"]
},
"validity": {
"not_before": "2025-01-01T00:00:00Z",
"not_after": "2026-01-01T00:00:00Z"
},
"subject_public_key_info": {
"algorithm": "ML-DSA-65",
"bit_size": 4096
},
"pqc_vulnerable": false,
"quantum_risk": "low",
"file_details": {
"path": "/etc/ssl/certs/server.crt",
"size": 2048,
"owner": "root",
"group": "root"
}
}
],
"keystore_results": [...],
"outlook_archive_results": [...]
}
Use different output formats for various use cases: JSON for processing, HTML for reporting, CBOM for compliance, FlatNDJSON for SIEM integration.
© 2025 . Part of .