How does Venafi discover certificates across an enterprise network?

Discovery in Venafi combines several collection methods so no single blind spot leaves a certificate untracked.

1. Network scanning: TPP probes IP ranges and ports, performing TLS handshakes to pull back whatever certificate a server presents, whether or not that certificate was ever requested through Venafi.
2. CA synchronization: Venafi connects directly to CAs (public and private, including Microsoft ADCS) and imports records of everything they've ever issued, catching certificates that never touched a scanned network segment.
3. Agent-based collection: lightweight agents on endpoints and the Venafi Kubernetes Agent report what's locally installed, useful for cloud workloads and clusters that a network scan can't easily reach.

The results get correlated into a single inventory record per certificate, deduplicated across the scan, CA, and agent sources, and each one is scored for risk — a weak key, a self-signed cert on a production host, or an unusually long validity period all raise flags automatically.