Domain Detective

API Reference

Class

CmdletInvokeCertificateInventory

Namespace DomainDetective.PowerShell
Assembly DomainDetective.PowerShell
Base PSCmdlet
Modifiers sealed
Attributes
Cmdlet("Invoke", "DDCertificateInventory") OutputType([typeof(CertificateInventoryCaptureResult)])

Captures and optionally persists a certificate inventory snapshot from domains and discovered endpoints.

Inheritance

  • PSCmdlet
  • CmdletInvokeCertificateInventory

Examples

Capture snapshot for explicit domains


Invoke-DDCertificateInventory -DomainName evotec.xyz,evotec.pl -CacheDirectory .\cert-monitor
        

Capture snapshot from file and export captured entries


Invoke-DDCertificateInventory -DomainsFile .\domains.txt -Endpoint https://api.example.com:8443
        

Capture snapshot with extended CT enrichment


Invoke-DDCertificateInventory -DomainName example.com -CtProfile Extended -EnableShodanCtSource -ShodanApiKeyEnv SHODAN_API_KEY
        

Capture snapshot including CT-discovered subdomains


Invoke-DDCertificateInventory -DomainName eurofins.com -IncludeCtSubdomains -VerifyCtSubdomains -MaxCtSubdomainsPerDomain 5000 -Verbose
        

Use native CT log polling without crt.sh fallback


Invoke-DDCertificateInventory -DomainName eurofins.com -IncludeCtSubdomains -EnableNativeCtLogSubdomains -NativeCtLogOnly -NativeCtInitialBackfillEntriesPerLog 5000 -Verbose
        

Run a throttled test capture


Invoke-DDCertificateInventory -DomainName eurofins.com -IncludeCtSubdomains -Limit 150 -MaxProbeStartsPerSecond 20 -MaxProbeErrorWarnings 10 -Verbose
        

Reuse recent captured endpoints to reduce repeated probing


Invoke-DDCertificateInventory -DomainName eurofins.com -IncludeCtSubdomains -ReuseRecentResults -RecentResultTtlHours 24 -ReprobeExpiringWithinDays 14
        

Reuse recent stable failures for short-lived verification lanes


Invoke-DDCertificateInventory -DomainName eurofins.com -ReuseRecentFailureResults -RecentFailureResultTtlHours 1 -HttpsTimeoutSeconds 20
        

Fail automation when warning-level target decisions are detected


Invoke-DDCertificateInventory -DomainName example.com -Endpoint ftp://example.com -FailOnWarningTargetDecisions
        

Constructors

Methods

EndProcessing() #

Performs endpoint discovery, certificate probing, and snapshot persistence.

ProcessRecord() #

Collects pipeline domain inputs for later capture execution.

Properties

public String[] DomainName { get; set; } #
Parameter(Mandatory = false, Position = 0, ValueFromPipeline = true, ValueFromPipelineByPropertyName = true)

Domain list to scan. Can be provided from pipeline.

public String DomainsFile { get; set; } #
Parameter(Mandatory = false)

Optional text file with domains/endpoints (one per line).

public String CacheDirectory { get; set; } #
Parameter(Mandatory = false)

Certificate monitor cache directory containing the inventory folder.

public DnsEndpoint DnsEndpoint { get; set; } #
Parameter(Mandatory = false)

DNS endpoint used for MX discovery.

public SwitchParameter NoApexHttps { get; set; } #
Parameter(Mandatory = false)

Do not probe apex domains over HTTPS.

public SwitchParameter NoWwwHttps { get; set; } #
Parameter(Mandatory = false)

Do not probe www.<domain> over HTTPS.

public SwitchParameter IncludeMxHttps { get; set; } #
Parameter(Mandatory = false)

Enable HTTPS probing for discovered MX hosts.

public SwitchParameter DisableMxDiscovery { get; set; } #
Parameter(Mandatory = false)

Disable MX discovery from DNS.

public SwitchParameter DisableSmtpStartTls { get; set; } #
Parameter(Mandatory = false)

Disable SMTP STARTTLS probing on port 25.

public SwitchParameter DisableSubmissionStartTls { get; set; } #
Parameter(Mandatory = false)

Disable SMTP STARTTLS probing on submission port 587.

public SwitchParameter IncludeImapTls { get; set; } #
Parameter(Mandatory = false)

Enable IMAP TLS probing on port 993.

public SwitchParameter IncludePop3Tls { get; set; } #
Parameter(Mandatory = false)

Enable POP3 TLS probing on port 995.

public SwitchParameter IncludeCtSubdomains { get; set; } #
Parameter(Mandatory = false)

Discover CT-observed subdomains for each input domain and probe them over HTTPS.

public SwitchParameter VerifyCtSubdomains { get; set; } #
Parameter(Mandatory = false)

When used with -IncludeCtSubdomains, only include CT subdomains that currently resolve in DNS.

public Int32 MaxCtRowsPerDomain { get; set; } #
Parameter(Mandatory = false) ValidateRange(0, 2147483647)

Maximum CT rows processed per domain when CT subdomain discovery is enabled (0 means no explicit cap override).

public Int32 MaxCtSubdomainsPerDomain { get; set; } #
Parameter(Mandatory = false) ValidateRange(0, 2147483647)

Maximum CT subdomains retained per domain when CT subdomain discovery is enabled (0 means no explicit cap override).

public SwitchParameter EnableNativeCtLogSubdomains { get; set; } #
Parameter(Mandatory = false)

Enable native RFC6962 CT log polling for CT subdomain discovery.

public SwitchParameter DisableNativeCtSharedIngestion { get; set; } #
Parameter(Mandatory = false)

Disable shared native CT ingestion pass across all domains (uses per-domain native CT discovery instead).

public SwitchParameter NativeCtLogOnly { get; set; } #
Parameter(Mandatory = false)

Use only native CT log polling for CT subdomain discovery (skip crt.sh/Cert Spotter).

public SwitchParameter EnablePassiveCtFallback { get; set; } #
Parameter(Mandatory = false)

Enable passive/public CT fallback for CT subdomain discovery.

public SwitchParameter EnablePassiveCtMetadataFallback { get; set; } #
Parameter(Mandatory = false)

Enable passive/public CT metadata rescue without broadly enabling passive CT discovery fallback.

public String NativeCtLogListUrl { get; set; } #
Parameter(Mandatory = false)

Native CT log list URL used to resolve CT logs.

public String[] NativeCtLogUrl { get; set; } #
Parameter(Mandatory = false)

Optional explicit CT log URL list for native CT polling.

public Int32 NativeCtMaxLogs { get; set; } #
Parameter(Mandatory = false) ValidateRange(0, 2147483647)

Maximum CT logs processed per domain when native CT polling is enabled.

public Int32 NativeCtMaxEntriesPerLog { get; set; } #
Parameter(Mandatory = false) ValidateRange(0, 2147483647)

Maximum CT entries processed per log per domain when native CT polling is enabled.

public Int32 NativeCtEntryBatchSize { get; set; } #
Parameter(Mandatory = false) ValidateRange(1, 2048)

Maximum get-entries batch size when native CT polling is enabled.

public Int32 NativeCtInitialBackfillEntriesPerLog { get; set; } #
Parameter(Mandatory = false) ValidateRange(0, 2147483647)

Initial per-log backfill when no native CT cursor exists (0 starts at current tree head).

public String NativeCtCursorStatePath { get; set; } #
Parameter(Mandatory = false)

Optional native CT cursor state file path (defaults to inventory/ct-native-cursor.json under CacheDirectory).

public SwitchParameter NativeCtIncludePendingLogs { get; set; } #
Parameter(Mandatory = false)

Include pending CT logs when using native CT log list ingestion.

public Int32 NativeCtRequestDelayMilliseconds { get; set; } #
Parameter(Mandatory = false) ValidateRange(0, 60000)

Optional delay in milliseconds between native CT requests.

public Int32 NativeCtRetryCount { get; set; } #
Parameter(Mandatory = false) ValidateRange(0, 20)

Maximum retry count for transient native CT HTTP failures.

public Int32 NativeCtRetryBaseDelayMilliseconds { get; set; } #
Parameter(Mandatory = false) ValidateRange(0, 60000)

Base delay in milliseconds between native CT retry attempts.

public Int32 NativeCtRetryMaxDelayMilliseconds { get; set; } #
Parameter(Mandatory = false) ValidateRange(0, 300000)

Maximum delay in milliseconds between native CT retry attempts.

public Int32 NativeCtCircuitBreakerFailureThreshold { get; set; } #
Parameter(Mandatory = false) ValidateRange(1, 100)

Consecutive native CT failures required before opening the per-log circuit breaker.

public Int32 NativeCtCircuitBreakerDurationSeconds { get; set; } #
Parameter(Mandatory = false) ValidateRange(1, 86400)

Native CT circuit-breaker open duration in seconds.

public SwitchParameter DisableNativeCtCatchUpMode { get; set; } #
Parameter(Mandatory = false)

Disable native CT catch-up mode that expands limits when cursor lag is high.

public Int32 NativeCtCatchUpLagThreshold { get; set; } #
Parameter(Mandatory = false) ValidateRange(1, 2147483647)

Native CT cursor lag threshold that enables catch-up mode.

public Int32 NativeCtCatchUpMaxEntriesPerLog { get; set; } #
Parameter(Mandatory = false) ValidateRange(0, 2147483647)

Maximum CT entries processed per log while native CT catch-up mode is active.

public Int32 NativeCtCatchUpBatchSize { get; set; } #
Parameter(Mandatory = false) ValidateRange(1, 2048)

Maximum get-entries batch size while native CT catch-up mode is active.

public String[] Endpoint { get; set; } #
Parameter(Mandatory = false)

Additional endpoint(s) to probe (supports https:// and mail schemes).

public Int32 MaxMxHostsPerDomain { get; set; } #
Parameter(Mandatory = false) ValidateRange(0, 2147483647)

Maximum MX hosts retained per domain (0 means unlimited).

public Int32 MaxParallelism { get; set; } #
Parameter(Mandatory = false) ValidateRange(1, 512)

Maximum concurrent probe operations.

public Int32 DiscoveryParallelism { get; set; } #
Parameter(Mandatory = false) ValidateRange(1, 512)

Maximum concurrent domain discovery operations.

public Int32 MailTimeoutSeconds { get; set; } #
Parameter(Mandatory = false) ValidateRange(1, 300)

Mail TLS timeout in seconds.

public Int32 HttpsTimeoutSeconds { get; set; } #
Parameter(Mandatory = false) ValidateRange(1, 300)

HTTPS certificate probe timeout in seconds.

public Int32 MaxProbeErrorWarnings { get; set; } #
Parameter(Mandatory = false) ValidateRange(0, 10000)

Maximum number of detailed endpoint probe error warnings to emit (0 emits only a summary warning).

public Int32 MaxTargets { get; set; } #
Parameter(Mandatory = false) Alias(["Limit"]) ValidateRange(0, 2147483647)

Maximum total probe targets (HTTPS + mail) kept after discovery; useful for quick test runs (0 means unlimited).

public Int32 MaxProbeStartsPerSecond { get; set; } #
Parameter(Mandatory = false) ValidateRange(0, 10000)

Maximum number of probe starts per second (0 means unlimited).

public SwitchParameter ReuseRecentResults { get; set; } #
Parameter(Mandatory = false)

Reuse recent persisted endpoint results to avoid re-probing unchanged endpoints.

public Int32 RecentResultTtlHours { get; set; } #
Parameter(Mandatory = false) ValidateRange(0, 8760)

How old persisted snapshot entries can be to qualify for reuse.

public SwitchParameter ReuseRecentFailureResults { get; set; } #
Parameter(Mandatory = false)

Reuse recent persisted stable failures to avoid immediately re-probing dead or timeout-heavy endpoints.

public Int32 RecentFailureResultTtlHours { get; set; } #
Parameter(Mandatory = false) ValidateRange(0, 8760)

How old persisted stable failure entries can be to qualify for reuse.

public Int32 ReprobeExpiringWithinDays { get; set; } #
Parameter(Mandatory = false) ValidateRange(0, 3650)

Always re-probe endpoints with certificates expiring within this many days.

public SwitchParameter SkipRevocation { get; set; } #
Parameter(Mandatory = false)

Skip revocation checks for HTTPS probes.

public CertificateCtEnrichmentProfile CtProfile { get; set; } #
Parameter(Mandatory = false)

CT enrichment profile. Values: Default, Disabled, Public, Extended.

public SwitchParameter DisableDefaultCtTemplate { get; set; } #
Parameter(Mandatory = false)

Disable the default crt.sh template during CT lookups.

public String[] CtApiTemplate { get; set; } #
Parameter(Mandatory = false)

Additional CT API templates (must include a {0} fingerprint placeholder).

public SwitchParameter EnableCensysCtSource { get; set; } #
Parameter(Mandatory = false)

Enable Censys CT source.

public String CensysApiId { get; set; } #
Parameter(Mandatory = false)

Censys API identifier.

public String CensysApiSecret { get; set; } #
Parameter(Mandatory = false)

Censys API secret. Prefer CensysApiSecretEnv for safer automation.

public String CensysApiSecretEnv { get; set; } #
Parameter(Mandatory = false)

Environment variable name containing Censys API secret.

public String CensysCtApiUrlTemplate { get; set; } #
Parameter(Mandatory = false)

Censys CT API URL template containing a {0} fingerprint placeholder.

public SwitchParameter EnableShodanCtSource { get; set; } #
Parameter(Mandatory = false)

Enable Shodan CT source.

public String ShodanApiKey { get; set; } #
Parameter(Mandatory = false)

Shodan API key. Prefer ShodanApiKeyEnv for safer automation.

public String ShodanApiKeyEnv { get; set; } #
Parameter(Mandatory = false)

Environment variable name containing Shodan API key.

public String ShodanCtApiUrlTemplate { get; set; } #
Parameter(Mandatory = false)

Shodan CT API URL template containing {0} fingerprint and {1} API key placeholders.

public SwitchParameter NoPersist { get; set; } #
Parameter(Mandatory = false)

Do not persist snapshot file; only return in-memory result.

public SwitchParameter FailOnWarningTargetDecisions { get; set; } #
Parameter(Mandatory = false)

When set, throw a terminating error when warning-level target-decision buckets are present.

{{ include "footer" }}