API Reference
CmdletInvokeCertificateInventory
Captures and optionally persists a certificate inventory snapshot from domains and discovered endpoints.
Inheritance
- PSCmdlet
- CmdletInvokeCertificateInventory
Examples
Capture snapshot for explicit domains
Invoke-DDCertificateInventory -DomainName evotec.xyz,evotec.pl -CacheDirectory .\cert-monitor
Capture snapshot from file and export captured entries
Invoke-DDCertificateInventory -DomainsFile .\domains.txt -Endpoint https://api.example.com:8443
Capture snapshot with extended CT enrichment
Invoke-DDCertificateInventory -DomainName example.com -CtProfile Extended -EnableShodanCtSource -ShodanApiKeyEnv SHODAN_API_KEY
Capture snapshot including CT-discovered subdomains
Invoke-DDCertificateInventory -DomainName eurofins.com -IncludeCtSubdomains -VerifyCtSubdomains -MaxCtSubdomainsPerDomain 5000 -Verbose
Use native CT log polling without crt.sh fallback
Invoke-DDCertificateInventory -DomainName eurofins.com -IncludeCtSubdomains -EnableNativeCtLogSubdomains -NativeCtLogOnly -NativeCtInitialBackfillEntriesPerLog 5000 -Verbose
Run a throttled test capture
Invoke-DDCertificateInventory -DomainName eurofins.com -IncludeCtSubdomains -Limit 150 -MaxProbeStartsPerSecond 20 -MaxProbeErrorWarnings 10 -Verbose
Reuse recent captured endpoints to reduce repeated probing
Invoke-DDCertificateInventory -DomainName eurofins.com -IncludeCtSubdomains -ReuseRecentResults -RecentResultTtlHours 24 -ReprobeExpiringWithinDays 14
Reuse recent stable failures for short-lived verification lanes
Invoke-DDCertificateInventory -DomainName eurofins.com -ReuseRecentFailureResults -RecentFailureResultTtlHours 1 -HttpsTimeoutSeconds 20
Fail automation when warning-level target decisions are detected
Invoke-DDCertificateInventory -DomainName example.com -Endpoint ftp://example.com -FailOnWarningTargetDecisions
Constructors
public CmdletInvokeCertificateInventory() #Methods
Inherited Methods
public PathInfo CurrentProviderLocation(String providerId) #PathInfoParameters
- providerId String
public override Boolean Equals(Object obj) #BooleanParameters
- obj Object
public Collection<String> GetResolvedProviderPathFromPSPath(String path, out ProviderInfo provider) #Collection<String>Parameters
- path String
- provider ProviderInfo
public override String GetResourceString(String baseName, String resourceId) #StringParameters
- baseName String
- resourceId String
public String GetUnresolvedProviderPathFromPSPath(String path) #StringParameters
- path String
public Object GetVariableValue(String name, Object defaultValue) #ObjectParameters
- name String
public Boolean ShouldContinue(String query, String caption) #BooleanParameters
- query String
- caption String
- hasSecurityImpact Boolean
- yesToAll Boolean
- noToAll Boolean
public Boolean ShouldProcess(String verboseDescription, String verboseWarning, String caption) #BooleanParameters
- verboseDescription String
- verboseWarning String
- caption String
- shouldProcessReason ShouldProcessReason
public Void ThrowTerminatingError(ErrorRecord errorRecord) #VoidParameters
- errorRecord ErrorRecord
public Void WriteCommandDetail(String text) #VoidParameters
- text String
public Void WriteError(ErrorRecord errorRecord) #VoidParameters
- errorRecord ErrorRecord
public Void WriteInformation(InformationRecord informationRecord) #VoidParameters
- messageData Object
- tags String[]
public Void WriteObject(Object sendToPipeline) #VoidParameters
- sendToPipeline Object
- enumerateCollection Boolean
public Void WriteProgress(ProgressRecord progressRecord) #VoidParameters
- progressRecord ProgressRecord
Properties
public String[] DomainName { get; set; } #Parameter(Mandatory = false, Position = 0, ValueFromPipeline = true, ValueFromPipelineByPropertyName = true)Domain list to scan. Can be provided from pipeline.
public String DomainsFile { get; set; } #Parameter(Mandatory = false)Optional text file with domains/endpoints (one per line).
public String CacheDirectory { get; set; } #Parameter(Mandatory = false)Certificate monitor cache directory containing the inventory folder.
public DnsEndpoint DnsEndpoint { get; set; } #Parameter(Mandatory = false)DNS endpoint used for MX discovery.
public SwitchParameter NoApexHttps { get; set; } #Parameter(Mandatory = false)Do not probe apex domains over HTTPS.
public SwitchParameter NoWwwHttps { get; set; } #Parameter(Mandatory = false)Do not probe www.<domain> over HTTPS.
public SwitchParameter IncludeMxHttps { get; set; } #Parameter(Mandatory = false)Enable HTTPS probing for discovered MX hosts.
public SwitchParameter DisableMxDiscovery { get; set; } #Parameter(Mandatory = false)Disable MX discovery from DNS.
public SwitchParameter DisableSmtpStartTls { get; set; } #Parameter(Mandatory = false)Disable SMTP STARTTLS probing on port 25.
public SwitchParameter DisableSubmissionStartTls { get; set; } #Parameter(Mandatory = false)Disable SMTP STARTTLS probing on submission port 587.
public SwitchParameter IncludeImapTls { get; set; } #Parameter(Mandatory = false)Enable IMAP TLS probing on port 993.
public SwitchParameter IncludePop3Tls { get; set; } #Parameter(Mandatory = false)Enable POP3 TLS probing on port 995.
public SwitchParameter IncludeCtSubdomains { get; set; } #Parameter(Mandatory = false)Discover CT-observed subdomains for each input domain and probe them over HTTPS.
public SwitchParameter VerifyCtSubdomains { get; set; } #Parameter(Mandatory = false)When used with -IncludeCtSubdomains, only include CT subdomains that currently resolve in DNS.
public Int32 MaxCtRowsPerDomain { get; set; } #Parameter(Mandatory = false) ValidateRange(0, 2147483647)Maximum CT rows processed per domain when CT subdomain discovery is enabled (0 means no explicit cap override).
public Int32 MaxCtSubdomainsPerDomain { get; set; } #Parameter(Mandatory = false) ValidateRange(0, 2147483647)Maximum CT subdomains retained per domain when CT subdomain discovery is enabled (0 means no explicit cap override).
public SwitchParameter EnableNativeCtLogSubdomains { get; set; } #Parameter(Mandatory = false)Enable native RFC6962 CT log polling for CT subdomain discovery.
public SwitchParameter NativeCtLogOnly { get; set; } #Parameter(Mandatory = false)Use only native CT log polling for CT subdomain discovery (skip crt.sh/Cert Spotter).
public SwitchParameter EnablePassiveCtFallback { get; set; } #Parameter(Mandatory = false)Enable passive/public CT fallback for CT subdomain discovery.
public SwitchParameter EnablePassiveCtMetadataFallback { get; set; } #Parameter(Mandatory = false)Enable passive/public CT metadata rescue without broadly enabling passive CT discovery fallback.
public String NativeCtLogListUrl { get; set; } #Parameter(Mandatory = false)Native CT log list URL used to resolve CT logs.
public String[] NativeCtLogUrl { get; set; } #Parameter(Mandatory = false)Optional explicit CT log URL list for native CT polling.
public Int32 NativeCtMaxLogs { get; set; } #Parameter(Mandatory = false) ValidateRange(0, 2147483647)Maximum CT logs processed per domain when native CT polling is enabled.
public Int32 NativeCtMaxEntriesPerLog { get; set; } #Parameter(Mandatory = false) ValidateRange(0, 2147483647)Maximum CT entries processed per log per domain when native CT polling is enabled.
public Int32 NativeCtEntryBatchSize { get; set; } #Parameter(Mandatory = false) ValidateRange(1, 2048)Maximum get-entries batch size when native CT polling is enabled.
public Int32 NativeCtInitialBackfillEntriesPerLog { get; set; } #Parameter(Mandatory = false) ValidateRange(0, 2147483647)Initial per-log backfill when no native CT cursor exists (0 starts at current tree head).
public String NativeCtCursorStatePath { get; set; } #Parameter(Mandatory = false)Optional native CT cursor state file path (defaults to inventory/ct-native-cursor.json under CacheDirectory).
public SwitchParameter NativeCtIncludePendingLogs { get; set; } #Parameter(Mandatory = false)Include pending CT logs when using native CT log list ingestion.
public Int32 NativeCtRequestDelayMilliseconds { get; set; } #Parameter(Mandatory = false) ValidateRange(0, 60000)Optional delay in milliseconds between native CT requests.
public Int32 NativeCtRetryCount { get; set; } #Parameter(Mandatory = false) ValidateRange(0, 20)Maximum retry count for transient native CT HTTP failures.
public Int32 NativeCtRetryBaseDelayMilliseconds { get; set; } #Parameter(Mandatory = false) ValidateRange(0, 60000)Base delay in milliseconds between native CT retry attempts.
public Int32 NativeCtRetryMaxDelayMilliseconds { get; set; } #Parameter(Mandatory = false) ValidateRange(0, 300000)Maximum delay in milliseconds between native CT retry attempts.
public Int32 NativeCtCircuitBreakerFailureThreshold { get; set; } #Parameter(Mandatory = false) ValidateRange(1, 100)Consecutive native CT failures required before opening the per-log circuit breaker.
public Int32 NativeCtCircuitBreakerDurationSeconds { get; set; } #Parameter(Mandatory = false) ValidateRange(1, 86400)Native CT circuit-breaker open duration in seconds.
public SwitchParameter DisableNativeCtCatchUpMode { get; set; } #Parameter(Mandatory = false)Disable native CT catch-up mode that expands limits when cursor lag is high.
public Int32 NativeCtCatchUpLagThreshold { get; set; } #Parameter(Mandatory = false) ValidateRange(1, 2147483647)Native CT cursor lag threshold that enables catch-up mode.
public Int32 NativeCtCatchUpMaxEntriesPerLog { get; set; } #Parameter(Mandatory = false) ValidateRange(0, 2147483647)Maximum CT entries processed per log while native CT catch-up mode is active.
public Int32 NativeCtCatchUpBatchSize { get; set; } #Parameter(Mandatory = false) ValidateRange(1, 2048)Maximum get-entries batch size while native CT catch-up mode is active.
public String[] Endpoint { get; set; } #Parameter(Mandatory = false)Additional endpoint(s) to probe (supports https:// and mail schemes).
public Int32 MaxMxHostsPerDomain { get; set; } #Parameter(Mandatory = false) ValidateRange(0, 2147483647)Maximum MX hosts retained per domain (0 means unlimited).
public Int32 MaxParallelism { get; set; } #Parameter(Mandatory = false) ValidateRange(1, 512)Maximum concurrent probe operations.
public Int32 DiscoveryParallelism { get; set; } #Parameter(Mandatory = false) ValidateRange(1, 512)Maximum concurrent domain discovery operations.
public Int32 MailTimeoutSeconds { get; set; } #Parameter(Mandatory = false) ValidateRange(1, 300)Mail TLS timeout in seconds.
public Int32 HttpsTimeoutSeconds { get; set; } #Parameter(Mandatory = false) ValidateRange(1, 300)HTTPS certificate probe timeout in seconds.
public Int32 MaxProbeErrorWarnings { get; set; } #Parameter(Mandatory = false) ValidateRange(0, 10000)Maximum number of detailed endpoint probe error warnings to emit (0 emits only a summary warning).
public Int32 MaxTargets { get; set; } #Parameter(Mandatory = false) Alias(["Limit"]) ValidateRange(0, 2147483647)Maximum total probe targets (HTTPS + mail) kept after discovery; useful for quick test runs (0 means unlimited).
public Int32 MaxProbeStartsPerSecond { get; set; } #Parameter(Mandatory = false) ValidateRange(0, 10000)Maximum number of probe starts per second (0 means unlimited).
public SwitchParameter ReuseRecentResults { get; set; } #Parameter(Mandatory = false)Reuse recent persisted endpoint results to avoid re-probing unchanged endpoints.
public Int32 RecentResultTtlHours { get; set; } #Parameter(Mandatory = false) ValidateRange(0, 8760)How old persisted snapshot entries can be to qualify for reuse.
public SwitchParameter ReuseRecentFailureResults { get; set; } #Parameter(Mandatory = false)Reuse recent persisted stable failures to avoid immediately re-probing dead or timeout-heavy endpoints.
public Int32 RecentFailureResultTtlHours { get; set; } #Parameter(Mandatory = false) ValidateRange(0, 8760)How old persisted stable failure entries can be to qualify for reuse.
public Int32 ReprobeExpiringWithinDays { get; set; } #Parameter(Mandatory = false) ValidateRange(0, 3650)Always re-probe endpoints with certificates expiring within this many days.
public SwitchParameter SkipRevocation { get; set; } #Parameter(Mandatory = false)Skip revocation checks for HTTPS probes.
public CertificateCtEnrichmentProfile CtProfile { get; set; } #Parameter(Mandatory = false)CT enrichment profile. Values: Default, Disabled, Public, Extended.
public SwitchParameter DisableDefaultCtTemplate { get; set; } #Parameter(Mandatory = false)Disable the default crt.sh template during CT lookups.
public String[] CtApiTemplate { get; set; } #Parameter(Mandatory = false)Additional CT API templates (must include a {0} fingerprint placeholder).
public SwitchParameter EnableCensysCtSource { get; set; } #Parameter(Mandatory = false)Enable Censys CT source.
public String CensysApiSecret { get; set; } #Parameter(Mandatory = false)Censys API secret. Prefer CensysApiSecretEnv for safer automation.
public String CensysApiSecretEnv { get; set; } #Parameter(Mandatory = false)Environment variable name containing Censys API secret.
public String CensysCtApiUrlTemplate { get; set; } #Parameter(Mandatory = false)Censys CT API URL template containing a {0} fingerprint placeholder.
public SwitchParameter EnableShodanCtSource { get; set; } #Parameter(Mandatory = false)Enable Shodan CT source.
public String ShodanApiKey { get; set; } #Parameter(Mandatory = false)Shodan API key. Prefer ShodanApiKeyEnv for safer automation.
public String ShodanApiKeyEnv { get; set; } #Parameter(Mandatory = false)Environment variable name containing Shodan API key.
public String ShodanCtApiUrlTemplate { get; set; } #Parameter(Mandatory = false)Shodan CT API URL template containing {0} fingerprint and {1} API key placeholders.
public SwitchParameter NoPersist { get; set; } #Parameter(Mandatory = false)Do not persist snapshot file; only return in-memory result.
public SwitchParameter FailOnWarningTargetDecisions { get; set; } #Parameter(Mandatory = false)When set, throw a terminating error when warning-level target-decision buckets are present.
Inherited Properties
public PSEventManager Events { get; } #public PSHost Host { get; } #public CommandInvocationIntrinsics InvokeCommand { get; } #public ProviderIntrinsics InvokeProvider { get; } #public JobManager JobManager { get; } #public JobRepository JobRepository { get; } #public InvocationInfo MyInvocation { get; } #public PagingParameters PagingParameters { get; } #public String ParameterSetName { get; } #public SessionState SessionState { get; } #public ICommandRuntime CommandRuntime { get; set; } #public Boolean Stopping { get; } #public CommandOrigin CommandOrigin { get; } #