Explain the internal working of Venafi's certificate discovery scanning?

Network-based discovery works by treating the TLS handshake itself as a data-collection opportunity — you don't need credentials on a server to see the certificate it presents to the world.

A scan job is scoped to a set of IP ranges and ports, and for each responding host, the scanner initiates a TLS handshake and captures whatever certificate the server offers — no login or agent is required, since this mirrors exactly what a normal client connecting to that server would see. Metadata is then parsed out (subject, SAN entries, issuer chain, key algorithm/size, validity dates) and compared against the existing inventory.

If the certificate is already known, the scan just refreshes its "last seen" location and timestamp, which is useful for confirming a certificate is still actually deployed where it's supposed to be. If it's new, Venafi creates a fresh inventory record and immediately risk-scores it — a weak key size or an unusually distant expiration date can flag it for review even before anyone requests it be brought under managed policy.