File System Scanner

The File System Scanner walks directory trees to find certificate and key files, parsing each one to extract cryptographic asset metadata.

What It Scans

Directories on the local filesystem (or mounted volumes) for certificate and key files. Identifies crypto files by extension and parses their contents.

Supported formats:

Extension	Format
.pem	PEM-encoded certificates and keys
.crt, .cer	X.509 certificates (PEM or DER)
.der	DER-encoded certificates
.key	Private key files
.p12, .pfx	PKCS#12 bundles
.jks	Java KeyStore files

How It Works

1. Walks the configured directory tree (respecting maxDepth)
2. Identifies cryptographic files by file extension
3. Parses each file to extract certificates, public keys, and private keys
4. Handles multi-certificate PEM files (certificate bundles)
5. Reports file path, permissions, and last-modified timestamp alongside asset metadata

Configuration

scanners:
  filesystem:
    - paths:
        - /etc/ssl/certs
        - /opt/app/keystores
        - /home/deploy/.ssh
      extensions:
        - .pem
        - .crt
        - .der
        - .p12
      recursive: true
      maxDepth: 5

Parameter	Required	Default	Description
paths	Yes	—	List of directories to scan
extensions	No	All supported	Filter to specific file extensions
recursive	No	true	Whether to scan subdirectories
maxDepth	No	10	Maximum directory depth for recursive scanning

Assets Produced

Asset Type	What’s Captured
certificate	subject, issuer, serialNumber, signatureAlgorithm, validity dates, keyUsage, SAN, file path
private-key	Algorithm, key size, encrypted status, file path
public-key	Algorithm, key size, file path

Deduplication

Certificates are deduplicated using SHA-256 of DER-encoded bytes. Keys are deduplicated using SHA-256 of the public key material. If the same certificate exists in multiple files, it appears once in inventory with all file locations referenced.

Use Cases

• Find all certificate and key files scattered across servers, including forgotten or unmanaged ones
• Detect private keys with weak permissions (world-readable key files)
• Identify expired certificates sitting on disk that may still be referenced by applications
• Discover PKCS#12 bundles that contain both certificates and private keys

Example Output

{
  "type": "certificate",
  "fingerprint": "sha256:b2c3d4e5f6a7...",
  "subject": "CN=internal.service.local",
  "issuer": "CN=Corp Internal CA",
  "signatureAlgorithm": "SHA256withECDSA",
  "notValidBefore": "2023-06-01T00:00:00Z",
  "notValidAfter": "2025-06-01T00:00:00Z",
  "isCA": false,
  "source": {
    "scanner": "filesystem",
    "filePath": "/etc/ssl/certs/internal-service.pem",
    "lastModified": "2023-06-01T12:34:56Z",
    "permissions": "644"
  }
}

---

← Back to Scanners Overview | Sensor Setup Guide