If Certificate discovery of Sectigo CA is failing, it could be because of one of the following issues.

1. Incorrect Credential – Open the pattern logs from discovery logs. Check the output of step 5 "Get Certificate List". If it is empty that means either credential alias/ credentials are not correct or there is some issue with API Url. Verify that the credential alias passed to the pattern is associated with the correct credential. To debug further-

• Do a simple curl command to Sectigo API to verify credentials

$ curl 'https://cert-manager.com/api/ssl/v1' -i -X GET \ -H 'login: xxxxxxx' \ -H 'Content-Type: application/json' \ -H 'customerUri: xxxxxx' \

-H 'password: xxxxxx'

If the above API call returns HTTP status 200, that means there isn't any issue with credential or url.

If it returns HTTP status 401 and {"code":-16,"description":"Unknown user"} that imples issue with credential. Please check your credential.

2. Incorrect API endpoint – We followed this Sectigo documentation for all the API endpoint, but Sectigo advised one of the customers to use "http://hard.cert-manager.com" API endpoint.

Do a simple curl command to sectigo API $ curl 'https://hard.cert-manager.com/api/ssl/v1' -i -X GET \ -H 'login: xxxxxxx' \ -H 'Content-Type: application/json' \ -H 'customerUri: xxxxxx' \

-H 'password: xxxxxx'

If it returns HTTP status code 200, then update the API URL in the pattern.

• Navigate to Discovery Patterns in Instance. Search for "Sectigo - Certificate Management".
• Open the pattern in the pattern designer.
• Update the API URL in 2nd step to "https://hard.cert-manager.com/api/ssl/" + $API_version
• Save the pattern. Publish it.
• Navigate to Discovery-> Mid server. Select "Pattern Sync to Mid.

3. Exclude Revoked Certificates - For fetching each certificate detail, pattern makes an API call to get PEM file of certificate. Once PEM file is received, we extract all the details like fingerprint, subject-common-name, serial number etc. from the PEM file and store each record in cmdb_ci_certificate table. However, Sectigo API does not return PEM file for revoked certificates. Hence, we need to exclude Revoked from the default certificate status list

• Navigate to Mid Server -> script include.
• Select SSlCertificateUtil. Update line 327 from

var discoverCertStatus = ['Issued', 'Expired', 'Revoked'];

to this

var discoverCertStatus = ['Issued', 'Expired'];

• Save it. Run discovery again.

There is a PRB created for fixing this revoked certificate issue. It will be fixed in Certificate Management V4.