Overview
NoCert finds the TLS/X.509 certificates your organization exposes, on public endpoints and on internal hosts, and keeps them in one inventory. It tells you when a certificate is about to expire, when its chain is broken, when its key is weak, and when an endpoint no longer meets your TLS policy.
How discovery works
Section titled “How discovery works”NoCert collects certificates from two places:
- Public endpoints. Verify a domain and NoCert enumerates its subdomains and scans their public TLS endpoints. No agent, no installation.
- Internal hosts. The Sentinel is a small open source agent you run on your own network. It probes the ranges you allow and the hosts NoCert asks it to check, reads certificates from disk, and reads Kubernetes secrets if you switch that on.
Both feed the same inventory, so a certificate served internally and publicly appears once, with every place it was seen.
What you get
Section titled “What you get”- A searchable inventory of certificates and the endpoints serving them.
- Expiry alerts by email, Slack, Teams or Discord, routed by rules you write.
- Warnings on broken or misordered chains, weak keys, and self-signed certificates, shown against each certificate.
- TLS compliance scoring against the ANSSI, BSI, NIST or Mozilla profiles.
Core concepts
Section titled “Core concepts”| Term | Meaning |
|---|---|
| Domain | A name you own and ask NoCert to monitor, proven with a DNS record. |
| Endpoint | An IP and port serving TLS, for example 203.0.113.10:443. |
| Certificate | An X.509 certificate seen on one or more endpoints, identified by its SHA-256 fingerprint. |
| Sentinel | An agent installed on your network for internal discovery. One Sentinel belongs to one organization. |
| Notification rule | An expiry threshold, such as 30 days before, plus the conditions that decide which certificates it covers. |
| Notification target | A named group of delivery channels for alerts: email, Slack, Teams, or Discord. |
| Connector | A DNS provider you link, such as Cloudflare or Route 53, so NoCert can read your zones and find names to monitor. |
| Compliance policy | A published TLS baseline (ANSSI, BSI, NIST or Mozilla) that your endpoints and certificates are scored against. |