Inside estate import

Import the internal certificate estate from an AD CS or CLM export, and read what each column becomes.

Purpose

The outside-in scan sees what the internet sees. The internal estate — domain controllers, the VPN concentrator, file servers, user certificates — only arrives by import. This is where most of the certificate count comes from.

Steps

1. Ask the customer's PKI operator for the export. On the issuing CA, verbatim:

certutil -view -restrict "Disposition=20" -out "RequestID,Request.Disposition,Request.DispositionMessage,Request.SubmittedWhen,Request.RequesterName,CertificateTemplate,SerialNumber,NotBefore,NotAfter,CommonName,RawCertificate" csv > adcs-export.csv

RawCertificate is mandatory. The signature algorithm, the subject alternative names, the key algorithm and size, the public-key fingerprint and the certificate template OID exist only in the certificate bytes — never in the CSV columns. A row whose blob was not exported comes through as the literal EMPTY, and the import falls back to the columns with honest nulls: no signature algorithm, no SANs, and the issuer reads Unknown issuer on the certificate-authority rollup.

A CLM export works too — the Sectigo SCM CSV and similar tools land on the Generic CLM profile. Without certificate bytes it carries no public key and no extended key usage, and the TLS grade stays unavailable until an outside-in scan reaches the same host.

2. Import it. On Console › Analyst Console, the Import certificate inventory card:

File — the CSV, JSON or CycloneDX document.
Format — CSV (certutil / CLM), JSON, or CycloneDX CBOM.
Mapping profile — Auto-detect (recommended; it reads the columns structurally, so a localised Windows export still resolves), Microsoft AD CS, or Generic CLM.
Press Preview. Nothing is written.
Read the counts, then press Confirm import.

3. Route what landed nowhere. Open Console › Assessment workspace, or follow the unrouted link from Inventory › Discovery Coverage (/assess?unrouted=1).

What the screen shows

Preview — badges for n rows, n certificates, n skipped, n issues, plus a sample of hosts with key and signature algorithm (no DER where the blob was absent).

Result — n imported · n updated · n skipped, and the estate assets created or updated, with conflicts recorded rather than overwritten.

Under the AD CS profile only issued certificates become evidence. Revoked, denied and pending rows are real history but not the live estate, so they are skipped and counted, not silently dropped. A row with neither a SAN nor a common name is skipped with its row number in the issues list.

Column to figure

From the export	Where it shows up
`NotAfter`	Certificate expiry, the expiry and already-expired alert rules
Key algorithm and size (from the bytes)	Inventory › Algorithms, the PQC position, the CBOM
Issuer (from the bytes)	Inventory › Certificate Authorities, issuer concentration and HHI
Public-key fingerprint (from the bytes)	The key-reuse rule: one private key across three or more hosts
`CertificateTemplate`, host name tokens, SANs	Which estate domain the asset routes to, and the rule that routed it
UPN and e-mail SANs	Replaced at ingest with a one-way `upn:` token — a staff address is never stored. The same person yields the same token, so a re-import groups onto the same row

Routing is a precedence table over host and SAN tokens, never a substring match, and every routed asset carries the reason it was routed — the rule id, or the asset type when nothing matched. An asset an analyst moved by hand carries the analyst instead.

Provenance

Figure	Tier
Algorithm, issuer, validity read from certificate bytes	`live`
The same fields on an `EMPTY` row, from CSV columns	`live` for what the column stated; `unknown` for what only the bytes carry
TLS grade for a host no outside-in scan reached	`empty` — not measured
Where an asset routed	carries its routing reason, analyst or rule

Common failures

Zero rows committed. Almost always a missing RawCertificate column, or an export restricted to something other than Disposition=20. Re-run the command as written.
A localised export. Headers are translated on a non-English Windows. Leave the mapping on Auto-detect — the disposition and blob columns are found by data shape, not header name.
File too large. The upload cap is about 8 MB of decoded text and 100,000 rows; a larger file is rejected with File too large and should be split.
Re-import conflicts. A second import of the same host updates the row and records a conflict rather than overwriting silently; the result line counts them.
Everything lands unrouted. Check that the estate domains exist — see Day 0 stand-up.

Previous: Outside-in scan · Next: Discovery interview

All steps: Analyst method

Search documentation