> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Network certificate discovery

> Learn how to configure a Network discovery job to find certificates across your infrastructure.

Network discovery scans network endpoints over TLS to discover certificates served by hosts across IP ranges and domains. Optionally, you can use an [Infisical Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md) to reach endpoints in private networks that aren't accessible from the internet.

> [!NOTE]
>
> If you're self-hosting Infisical, you can alternatively set the [`ALLOW_INTERNAL_IP_CONNECTIONS`](https://infisical.com/docs/self-hosting/configuration/envars#param-allow-internal-ip-connections) environment variable to `true` on your instance to scan private networks directly without a gateway.

> [tab] Infisical UI
>
> **Step 1**
>
> In **Certificate Manager**, go to **Discovery** and select **Add Job**, then select **Network**.
>
> **Step 2**
>
> Under **Targets**, set what to scan:
>
> * **Targets**: Domains, IP addresses, or CIDR ranges to scan, such as `example.com`, `192.168.1.1`, or `10.0.0.0/24`
>
> * **Ports**: Ports to scan for TLS certificates (defaults to common TLS ports)
>
> * **Gateway** (optional): The Infisical Gateway for scanning private networks
>
> > [!NOTE]
> >
> > At least one target (domain or IP) must be specified.
>
> **Step 3**
>
> Enter a **Name** and an optional **Description**. To run the job on a schedule, turn on **Scan on a Schedule** and pick a **Scan Interval**.
>
> **Step 4**
>
> Review the job and select **Create Job**.
>
> **Step 5**
>
> Open the job and select **Trigger Scan**, or wait for the next scheduled scan.
>
> **Step 6**
>
> After a scan completes, view the results:
>
> * **Installations**: Unique locations where certificates were found
> * **Certificates**: Details including common name, issuer, and expiration date
> * **Scan History**: Log of all scans with status and timestamps

> [tab] API
>
> To create a **Network** discovery job, make an API request to the [Create Discovery](https://infisical.com/docs/api-reference/endpoints/pki-discovery/create.md) API endpoint.
>
> ### Sample request
>
> ```bash Request theme={"dark"}
> curl --request POST \
>   --url https://app.infisical.com/api/v1/pki/discovery \
>   --header 'Authorization: Bearer <access-token>' \
>   --header 'Content-Type: application/json' \
>   --data '{
>     "name": "prod-tls-scan",
>     "description": "Scan production network for TLS certificates",
>     "type": "network-tls",
>     "gatewayId": "550e8400-e29b-41d4-a716-446655440000",
>     "isAutoScanEnabled": true,
>     "scanIntervalInDays": 1,
>     "targetConfig": {
>       "ipRanges": ["10.0.0.0/24", "192.168.1.1"],
>       "domains": ["example.com"],
>       "ports": "443, 8443"
>     }
>   }'
> ```
>
> To trigger a scan, make a request to the [Trigger Scan](https://infisical.com/docs/api-reference/endpoints/pki-discovery/trigger-scan.md) endpoint:
>
> ```bash Request theme={"dark"}
> curl --request POST \
>   --url https://app.infisical.com/api/v1/pki/discovery/<discoveryId>/scan \
>   --header 'Authorization: Bearer <access-token>'
> ```

## Limits

The following limits apply to Network discovery jobs:

* **Max individual IPs**: 256
* **Max domains**: 20
* **Max ports**: 5
* **Minimum CIDR prefix**: `/24` (256 hosts)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.