What the Sentinel is
The Sentinel finds the certificates public scanning can’t reach, on hosts inside your network, and reports them to NoCert. It is a single open source Go binary, running as a systemd service on Debian and Ubuntu.
Install it on a host that can reach the ranges you care about. One Sentinel belongs to one organization.
What it finds
Section titled “What it finds”| Scan | What it looks at |
|---|---|
| Network | TLS endpoints on the IP ranges you allow. |
| Filesystem | Well-known certificate directories (Let’s Encrypt, Docker, Kubernetes and k3s/RKE2 PKI), plus the paths referenced by configuration files under /etc. The system trust store is skipped: it holds public CAs, not your certificates. |
| Local | The host’s own listening TLS ports, read from /proc/net/tcp and /proc/net/tcp6. This is what catches a certificate renewed on disk while the service serving it was never reloaded. Ports that are plaintext or STARTTLS by default (SSH, SMTP, MySQL, PostgreSQL and the like) are skipped, and a Sentinel in a container sees only that container’s listeners. |
| Kubernetes | TLS Secrets in the clusters you connect to it, plus a short published list of mesh CA Secrets and ConfigMaps (Istio, Linkerd). Public certificate material only. |
You choose which of these run, both in NoCert and on the host itself. Network and filesystem scans covers each one.
What it sends back
Section titled “What it sends back”Certificates as raw DER, and where each one was seen: an IP and port, or a file path. For a network probe it also reports what the handshake negotiated: protocol version, cipher suite, key-exchange group, OCSP stapling and HSTS.
It never sends a private key, and never sends the path of one. When it finds a key file sitting next to a certificate it reads the file mode and reports a single fact: whether any group or other bit is set.
What decides its work
Section titled “What decides its work”NoCert does. The Sentinel asks for tasks, runs them, and reports. It has no scheduler of its own, and it never widens a range it was given.
Outbound connections
Section titled “Outbound connections”The Sentinel listens on nothing. It needs two outbound HTTPS flows on TCP 443: the Sentinel itself talks to sentinel.nocert.io, and APT fetches packages from repo.nocert.io. Forward proxies are supported.
Every request after the initial enrollment is signed with an Ed25519 key (RFC 9421) that the Sentinel generates on the host and never transmits. It rotates that key on its own.
Why the source is public
Section titled “Why the source is public”Because you are the one being asked to run it on your network. The Sentinel is Apache-2.0, and the current release is published as a signed archive: nocert-sentinel-src.tar.gz with its signature, made with the key that signs the APT repository. It vendors its dependencies and builds offline.