Find every TLS certificate on your network
Scan hosts, CIDR networks and address ranges on any port from inside your own network, and get an inventory of every certificate: expiry, issuer, key, trust and protocol. The scan runs on your computer and sends no data to aethercert.
Version 1.1.2 · 27 October 2026 · Windows x64 · free · Download the aethercert Toolkit
A local TLS scan for the hosts the internet cannot see
Public scanners only see what is reachable from the internet. Intranet portals, LDAPS on domain controllers, Remote Desktop, management interfaces and internal mail servers are where certificates expire unnoticed. The certificate scanner runs where those hosts are: on a computer inside the network.
It offers this computer's own networks as targets and estimates how long a scan will take before it starts; while it runs, it shows the time left. STARTTLS is negotiated on SMTP, IMAP, POP3 and FTP ports and RDP on its port, so mail servers and Remote Desktop hosts appear in the inventory too.
How a certificate scan works
- 01
Enter targets
Host names, CIDR networks up to /16 and ranges such as 10.0.1.10-50 - or one of this computer's networks.
- 02
Choose ports
Any list or range of ports: 443, 636 for LDAPS, 3389 for RDP, 25 for SMTP, 8443 and whatever else you run.
- 03
Scan
Many connections at once, each with a timeout. The estimate tells you up front how long it will take.
- 04
Review and export
Filter for self-signed certificates, name mismatches and ports without TLS, save any certificate found, export as CSV or JSON.
What the certificate scanner finds
Hosts, networks and ranges
Mix host names, CIDR notation and address ranges in one scan, up to 65,536 addresses and 262,144 host and port probes.
Any port, STARTTLS and RDP
Implicit TLS on any port, STARTTLS for SMTP, IMAP, POP3 and FTP, and the RDP negotiation on Remote Desktop ports.
Legacy servers too
Servers too old for a modern TLS stack still appear: up to TLS 1.2 the certificate travels in the clear and is read from that exchange.
Trust as your clients see it
Chains are checked against the bundled Mozilla roots, the Windows store - including an enterprise CA rolled out by group policy - and an optional PEM bundle.
Broken chains included
The handshake accepts any certificate, so expired, self-signed and untrusted certificates land in the inventory with the reason.
CSV and versioned JSON
CSV for spreadsheets, JSON with a versioned schema (aethercert.toolkit.cert-scan/v1) for your own tooling.
Scheduled inventories with actk
actk scan runs the same scan from a scheduled task or a script, with the inventory written as CSV and JSON.
actk scan 10.0.0.0/24 10.0.1.10-50 srv01.corp.local -p 443,636,3389,8443 --csv inventory.csv --json inventory.jsonactk scan 10.20.0.0/22 -p 25,443,993 --tls-only --ca-file corp-root.pemMore tools in the Toolkit
Documentation
Frequently asked questions
Certificate scanner
Is it safe to scan my network?
The scanner opens TLS connections the way a client does and reads the certificate; it does not log in or change anything. Scan only networks you are responsible for, and let your security team know - an intrusion detection system may notice a sweep.
How large a network can I scan?
Up to 65,536 addresses (a /16) and 262,144 host and port probes per scan, so a typo such as /8 fails before it starts. Split larger estates into several scans.
Does it find certificates on ports other than 443?
Yes - any port you list. Mail ports use STARTTLS, Remote Desktop uses its own negotiation, and every other port is tried as implicit TLS.
Can I run a scan on a schedule?
Yes: put actk scan in a scheduled task and write the results to CSV or JSON. Comparing those files over time shows new, changed and expiring certificates.
Are the results sent anywhere?
No. The inventory stays on your computer until you export it.
Found certificates that expire soon?
aethercert renews and installs them for you, from public ACME CAs or your internal CA.
Community plan, no card required. Open registration - your account is ready in a few minutes.