API Reference

Class

CertificateMonitor

Edit on GitHub

Namespace DomainDetective

Assembly DomainDetective

Source DomainDetective/CertificateMonitor.cs:57

Implements

IDisposable

Aggregates certificate validity information for multiple hosts.

Inheritance

Object
CertificateMonitor

Remarks

The monitor periodically connects to configured hosts and records certificate details such as expiration, validity, and chain state.

Constructors

public CertificateMonitor() #

DomainDetective/CertificateMonitor.cs:57

Methods

public async Task Analyze(IEnumerable<String> hosts, Int32 port = 443, InternalLogger logger = null, CancellationToken cancellationToken = null, Boolean showProgress = true)

Returns: Task

Checks certificates for the provided hosts.

Parameters

hosts System.Collections.Generic.IEnumerable{System.String} requiredposition: 0: Hostnames or URLs to verify.
port System.Int32 = 443 optionalposition: 1: Port used for HTTPS.
logger DomainDetective.InternalLogger = null optionalposition: 2: Logger instance for diagnostics.
cancellationToken System.Threading.CancellationToken = null optionalposition: 3: Optional cancellation token.
showProgress System.Boolean = true optionalposition: 4: When true, writes progress via the logger.

public CertificateInventoryDiffSummary BuildInventoryDiff(Nullable<DateTimeOffset> sinceUtc = null, Nullable<DateTimeOffset> previousCapturedAtUtc = null, Nullable<DateTimeOffset> currentCapturedAtUtc = null, Boolean includeUnchanged = false, Int32 maxEndpoints = 500)

DomainDetective/CertificateMonitor.cs:524

Returns: CertificateInventoryDiffSummary

Builds a point-in-time diff between two inventory snapshots.

Parameters

sinceUtc System.Nullable{System.DateTimeOffset} = null optionalposition: 0: Optional lower bound for snapshot capture time.
previousCapturedAtUtc System.Nullable{System.DateTimeOffset} = null optionalposition: 1: Optional previous snapshot timestamp selector.
currentCapturedAtUtc System.Nullable{System.DateTimeOffset} = null optionalposition: 2: Optional current snapshot timestamp selector.
includeUnchanged System.Boolean = false optionalposition: 3: When true, includes unchanged endpoints in results.
maxEndpoints System.Int32 = 500 optionalposition: 4: Maximum endpoint rows returned.

public CertificateInventoryDriftSummary BuildInventoryDrift(Nullable<DateTimeOffset> sinceUtc = null, Boolean changedOnly = false, Int32 maxEndpoints = 200, String minimumSeverity = null, IEnumerable<String> requiredChangeKinds = null, String changeKindMatchMode = null)

DomainDetective/CertificateMonitor.cs:502

Returns: CertificateInventoryDriftSummary

Builds endpoint-level certificate drift history from persisted inventory snapshots.

Parameters

sinceUtc System.Nullable{System.DateTimeOffset} = null optionalposition: 0: Optional lower bound for snapshot capture time.
changedOnly System.Boolean = false optionalposition: 1: When true, only returns endpoints with observed changes.
maxEndpoints System.Int32 = 200 optionalposition: 2: Maximum number of endpoint rows returned.
minimumSeverity System.String = null optionalposition: 3: Optional minimum drift severity filter (None, Low, Medium, High).
requiredChangeKinds System.Collections.Generic.IEnumerable{System.String} = null optionalposition: 4: Optional list of required drift change kinds (certificate, issuer, expiry, service, auth-profile, chain-source).
changeKindMatchMode System.String = null optionalposition: 5: Optional change-kind matching mode (Any or All).

public CertificateInventoryNativeCtDiagnosticsHealthSummary BuildInventoryNativeCtDiagnosticsHealth(CertificateInventoryNativeCtDiagnosticsHealthQuery query = null)

DomainDetective/CertificateMonitor.QueryAndCounters.cs:92

Returns: CertificateInventoryNativeCtDiagnosticsHealthSummary

Builds CT diagnostics health timeline from persisted inventory snapshots.

Parameters

query DomainDetective.CertificateInventoryNativeCtDiagnosticsHealthQuery = null optionalposition: 0: Health query options including thresholds and snapshot window.

public CertificateInventoryPolicySummary BuildInventoryPolicy(Nullable<DateTimeOffset> sinceUtc = null, String baselineProfile = "Balanced", Boolean includeCompliant = false, Int32 maxEndpoints = 300, CertificateInventoryPolicyOverrides policyOverrides = null)

DomainDetective/CertificateMonitor.RiskPolicyReuse.cs:160

Returns: CertificateInventoryPolicySummary

Builds endpoint-level certificate policy posture from persisted inventory snapshots.

Parameters

sinceUtc System.Nullable{System.DateTimeOffset} = null optionalposition: 0: Optional lower bound for snapshot capture time.
baselineProfile System.String = "Balanced" optionalposition: 1: Policy baseline profile (Strict, Balanced, Legacy).
includeCompliant System.Boolean = false optionalposition: 2: When true, includes endpoints with no policy violations.
maxEndpoints System.Int32 = 300 optionalposition: 3: Maximum endpoint rows returned.
policyOverrides DomainDetective.CertificateInventoryPolicyOverrides = null optionalposition: 4: Optional organization override rules for baseline/profile suppression.

public CertificateInventoryPolicyDriftSummary BuildInventoryPolicyDrift(Nullable<DateTimeOffset> sinceUtc = null, String baselineProfile = "Balanced", Nullable<DateTimeOffset> previousCapturedAtUtc = null, Nullable<DateTimeOffset> currentCapturedAtUtc = null, Boolean changedOnly = true, Int32 maxEndpoints = 300, CertificateInventoryPolicyOverrides policyOverrides = null)

DomainDetective/CertificateMonitor.RiskPolicyReuse.cs:185

Returns: CertificateInventoryPolicyDriftSummary

Builds endpoint-level certificate policy drift between two persisted inventory snapshots.

Parameters

sinceUtc System.Nullable{System.DateTimeOffset} = null optionalposition: 0: Optional lower bound for snapshot capture time.
baselineProfile System.String = "Balanced" optionalposition: 1: Policy baseline profile (Strict, Balanced, Legacy).
previousCapturedAtUtc System.Nullable{System.DateTimeOffset} = null optionalposition: 2: Optional previous snapshot timestamp selector (selects latest snapshot at or before timestamp).
currentCapturedAtUtc System.Nullable{System.DateTimeOffset} = null optionalposition: 3: Optional current snapshot timestamp selector (selects latest snapshot at or before timestamp).
changedOnly System.Boolean = true optionalposition: 4: When true, only returns endpoint rows with detected policy drift.
maxEndpoints System.Int32 = 300 optionalposition: 5: Maximum endpoint rows returned.
policyOverrides DomainDetective.CertificateInventoryPolicyOverrides = null optionalposition: 6: Optional organization override rules for baseline/profile suppression.

public CertificateInventoryReuseSummary BuildInventoryReuse(Nullable<DateTimeOffset> sinceUtc = null, Boolean includeSingleEndpointCertificates = false, Int32 minEndpointCount = 2, Int32 maxCertificates = 300, Int32 maxEndpointsPerCertificate = 30)

DomainDetective/CertificateMonitor.RiskPolicyReuse.cs:314

Returns: CertificateInventoryReuseSummary

Builds certificate reuse and assignment mapping from persisted inventory snapshots.

Parameters

sinceUtc System.Nullable{System.DateTimeOffset} = null optionalposition: 0: Optional lower bound for snapshot capture time.
includeSingleEndpointCertificates System.Boolean = false optionalposition: 1: When true, includes certificates used by only one endpoint.
minEndpointCount System.Int32 = 2 optionalposition: 2: Minimum endpoint count required per certificate.
maxCertificates System.Int32 = 300 optionalposition: 3: Maximum certificate rows returned.
maxEndpointsPerCertificate System.Int32 = 30 optionalposition: 4: Maximum endpoint references returned per certificate row.

public CertificateInventoryRiskSummary BuildInventoryRisk(Nullable<DateTimeOffset> sinceUtc = null, Boolean includeNoRisk = false, Int32 expiringWithinDays = 30, Int32 criticalExpiringWithinDays = 7, Int32 maxEndpoints = 300, String minimumSeverity = null, Nullable<Int32> scoreMin = null, Nullable<Int32> scoreMax = null, Nullable<Int32> reasonCountMin = null, Nullable<Int32> reasonCountMax = null, String riskProfile = null, String reasonContains = null, String issuerContains = null, String authorityFamilyEquals = null, String rootAuthorityFamilyEquals = null, String ctSourceContains = null, String ctTemplateErrorContains = null, String chainSourceContains = null, String thumbprintEquals = null, String rootThumbprintEquals = null, String serialNumberEquals = null, String hostContains = null, String serviceEquals = null, Nullable<Int32> portEquals = null, Nullable<Int32> chainLengthMin = null, Nullable<Int32> chainLengthMax = null, Nullable<Int32> intermediateCountMin = null, Nullable<Int32> intermediateCountMax = null, Nullable<Boolean> ctObservedOnly = null, Nullable<Boolean> chainCompleteOnly = null, Nullable<Boolean> reachableOnly = null, Nullable<Boolean> hostnameMatchOnly = null, Nullable<Boolean> selfSignedOnly = null, Nullable<Boolean> weakKeyOnly = null, Nullable<Boolean> sha1SignatureOnly = null, Nullable<Boolean> expiredOnly = null, Nullable<Boolean> notYetValidOnly = null, Nullable<Boolean> currentlyValidOnly = null, Nullable<Int32> daysToExpireMin = null, Nullable<Int32> daysToExpireMax = null, Nullable<Int32> daysUntilValidMin = null, Nullable<Int32> daysUntilValidMax = null, Nullable<Boolean> knownAuthorityOnly = null, Nullable<Boolean> knownRootAuthorityOnly = null, String authenticationProfileEquals = null, Boolean serverAuthOnly = false, Boolean clientAuthOnly = false, Boolean secureEmailOnly = false, String[] reasonAnyOf = null, String[] reasonAllOf = null, String[] issuerContainsAnyOf = null, String[] issuerContainsAllOf = null, String rootIssuerContains = null, String[] rootIssuerContainsAnyOf = null, String[] rootIssuerContainsAllOf = null, Nullable<Int32> certificateReuseEndpointCountMin = null, Nullable<Int32> certificateReuseEndpointCountMax = null, Nullable<Boolean> certificateReuseCrossServiceOnly = null, Nullable<Int32> certificateReuseDistinctServiceCountMin = null, Nullable<Int32> certificateReuseDistinctServiceCountMax = null, Nullable<Int32> certificateReuseDistinctPortCountMin = null, Nullable<Int32> certificateReuseDistinctPortCountMax = null, Nullable<Boolean> certificateReuseCrossPortOnly = null)

DomainDetective/CertificateMonitor.RiskPolicyReuse.cs:81

Returns: CertificateInventoryRiskSummary

Builds inventory risk.

Parameters

sinceUtc System.Nullable{System.DateTimeOffset} = null optionalposition: 0
includeNoRisk System.Boolean = false optionalposition: 1
expiringWithinDays System.Int32 = 30 optionalposition: 2
criticalExpiringWithinDays System.Int32 = 7 optionalposition: 3
maxEndpoints System.Int32 = 300 optionalposition: 4
minimumSeverity System.String = null optionalposition: 5
scoreMin System.Nullable{System.Int32} = null optionalposition: 6
scoreMax System.Nullable{System.Int32} = null optionalposition: 7
reasonCountMin System.Nullable{System.Int32} = null optionalposition: 8
reasonCountMax System.Nullable{System.Int32} = null optionalposition: 9
riskProfile System.String = null optionalposition: 10
reasonContains System.String = null optionalposition: 11
issuerContains System.String = null optionalposition: 12
authorityFamilyEquals System.String = null optionalposition: 13
rootAuthorityFamilyEquals System.String = null optionalposition: 14
ctSourceContains System.String = null optionalposition: 15
ctTemplateErrorContains System.String = null optionalposition: 16
chainSourceContains System.String = null optionalposition: 17
thumbprintEquals System.String = null optionalposition: 18
rootThumbprintEquals System.String = null optionalposition: 19
serialNumberEquals System.String = null optionalposition: 20
hostContains System.String = null optionalposition: 21
serviceEquals System.String = null optionalposition: 22
portEquals System.Nullable{System.Int32} = null optionalposition: 23
chainLengthMin System.Nullable{System.Int32} = null optionalposition: 24
chainLengthMax System.Nullable{System.Int32} = null optionalposition: 25
intermediateCountMin System.Nullable{System.Int32} = null optionalposition: 26
intermediateCountMax System.Nullable{System.Int32} = null optionalposition: 27
ctObservedOnly System.Nullable{System.Boolean} = null optionalposition: 28
chainCompleteOnly System.Nullable{System.Boolean} = null optionalposition: 29
reachableOnly System.Nullable{System.Boolean} = null optionalposition: 30
hostnameMatchOnly System.Nullable{System.Boolean} = null optionalposition: 31
selfSignedOnly System.Nullable{System.Boolean} = null optionalposition: 32
weakKeyOnly System.Nullable{System.Boolean} = null optionalposition: 33
sha1SignatureOnly System.Nullable{System.Boolean} = null optionalposition: 34
expiredOnly System.Nullable{System.Boolean} = null optionalposition: 35
notYetValidOnly System.Nullable{System.Boolean} = null optionalposition: 36
currentlyValidOnly System.Nullable{System.Boolean} = null optionalposition: 37
daysToExpireMin System.Nullable{System.Int32} = null optionalposition: 38
daysToExpireMax System.Nullable{System.Int32} = null optionalposition: 39
daysUntilValidMin System.Nullable{System.Int32} = null optionalposition: 40
daysUntilValidMax System.Nullable{System.Int32} = null optionalposition: 41
knownAuthorityOnly System.Nullable{System.Boolean} = null optionalposition: 42
knownRootAuthorityOnly System.Nullable{System.Boolean} = null optionalposition: 43
authenticationProfileEquals System.String = null optionalposition: 44
serverAuthOnly System.Boolean = false optionalposition: 45
clientAuthOnly System.Boolean = false optionalposition: 46
secureEmailOnly System.Boolean = false optionalposition: 47
reasonAnyOf System.String[] = null optionalposition: 48
reasonAllOf System.String[] = null optionalposition: 49
issuerContainsAnyOf System.String[] = null optionalposition: 50
issuerContainsAllOf System.String[] = null optionalposition: 51
rootIssuerContains System.String = null optionalposition: 52
rootIssuerContainsAnyOf System.String[] = null optionalposition: 53
rootIssuerContainsAllOf System.String[] = null optionalposition: 54
certificateReuseEndpointCountMin System.Nullable{System.Int32} = null optionalposition: 55
certificateReuseEndpointCountMax System.Nullable{System.Int32} = null optionalposition: 56
certificateReuseCrossServiceOnly System.Nullable{System.Boolean} = null optionalposition: 57
certificateReuseDistinctServiceCountMin System.Nullable{System.Int32} = null optionalposition: 58
certificateReuseDistinctServiceCountMax System.Nullable{System.Int32} = null optionalposition: 59
certificateReuseDistinctPortCountMin System.Nullable{System.Int32} = null optionalposition: 60
certificateReuseDistinctPortCountMax System.Nullable{System.Int32} = null optionalposition: 61
certificateReuseCrossPortOnly System.Nullable{System.Boolean} = null optionalposition: 62

public CertificateInventorySummary BuildInventorySummary(Nullable<DateTimeOffset> sinceUtc = null, Int32 expiringWithinDays = 30, Int32 maxExpiringEndpoints = 200)

DomainDetective/CertificateMonitor.cs:481

Returns: CertificateInventorySummary

Builds a normalized summary view for persisted inventory snapshots.

Parameters

sinceUtc System.Nullable{System.DateTimeOffset} = null optionalposition: 0: Optional lower bound for snapshot capture time.
expiringWithinDays System.Int32 = 30 optionalposition: 1: Threshold window for expiring certificates.
maxExpiringEndpoints System.Int32 = 200 optionalposition: 2: Maximum number of expiring endpoints in the summary.

public virtual Void Dispose() #

DomainDetective/CertificateMonitor.QueryAndCounters.cs:428

Returns: Void

Disposes timer resources.

public IReadOnlyList<CertificateInventorySnapshot> LoadInventorySnapshots(Nullable<DateTimeOffset> sinceUtc = null, Nullable<DateTimeOffset> untilUtc = null, Int32 maxSnapshots = 0, Boolean latestOnly = false)

DomainDetective/CertificateMonitor.cs:290

Returns: IReadOnlyList<CertificateInventorySnapshot>

Loads persisted inventory snapshots from disk.

Parameters

sinceUtc System.Nullable{System.DateTimeOffset} = null optionalposition: 0: Optional lower bound for snapshot capture time.
untilUtc System.Nullable{System.DateTimeOffset} = null optionalposition: 1: Optional upper bound for snapshot capture time.
maxSnapshots System.Int32 = 0 optionalposition: 2: Optional maximum number of snapshots to return (latest N).
latestOnly System.Boolean = false optionalposition: 3: When true, returns only the latest available snapshot after filtering.

public CertificateInventoryQueryResult QueryInventoryEntries(CertificateInventoryQuery query = null) #

DomainDetective/CertificateMonitor.QueryAndCounters.cs:19

Returns: CertificateInventoryQueryResult

Queries persisted inventory entries using structured filters.

Parameters

query DomainDetective.CertificateInventoryQuery = null optionalposition: 0: Query options.

public CertificateInventoryNativeCtDiagnosticsResult QueryInventoryNativeCtDiagnostics(CertificateInventoryNativeCtDiagnosticsQuery query = null)

DomainDetective/CertificateMonitor.QueryAndCounters.cs:83

Returns: CertificateInventoryNativeCtDiagnosticsResult

Queries persisted native CT ingestion diagnostics captured alongside inventory snapshots.

Parameters

query DomainDetective.CertificateInventoryNativeCtDiagnosticsQuery = null optionalposition: 0: Native CT diagnostics query options.

public String SaveInventorySnapshot(CertificateInventorySnapshot snapshot, InternalLogger logger = null) #

DomainDetective/CertificateMonitor.cs:353

Returns: String

Persists the provided inventory snapshot to disk.

Parameters

snapshot DomainDetective.CertificateInventorySnapshot requiredposition: 0: Snapshot to persist.
logger DomainDetective.InternalLogger = null optionalposition: 1: Optional logger for non-terminating persistence errors.

Returns

Absolute path of the saved snapshot file, or an empty string when persistence fails.

public Void Start(IEnumerable<String> hosts, TimeSpan interval, Int32 port = 443, InternalLogger logger = null) #

DomainDetective/CertificateMonitor.cs:120

Returns: Void

Begins periodic monitoring of the specified hosts.

Parameters

hosts System.Collections.Generic.IEnumerable{System.String} requiredposition: 0: Hosts to monitor.
interval System.TimeSpan requiredposition: 1: Interval between checks.
port System.Int32 = 443 optionalposition: 2: Port used for HTTPS.
logger DomainDetective.InternalLogger = null optionalposition: 3: Optional logger instance.