What the sensor does
The NextPKI sensor is a single static binary that runs inside your network, finds TLS certificates and reports their metadata. It exists because the certificates that hurt you are the ones nobody wrote down: the expired one on an appliance, the self-signed one on a printer, the forgotten host still serving traffic.
What it finds
Section titled “What it finds”| Mode | Protocols |
|---|---|
| Direct TLS | HTTPS, SMTPS (465), IMAPS (993), POP3S (995) |
| STARTTLS upgrade | SMTP (25, 587), IMAP (143), POP3 (110) |
A target is a hostname, a single address or a CIDR range (v4 or v6), each with its own ports and, where the port convention is not enough, its own protocol. Include and exclude lists apply on top. For each service that completes a handshake, the sensor extracts the certificate chain, fingerprint, issuer, subject, SANs and validity window. See configuration.
What it does not do
Section titled “What it does not do”This list is the point of publishing the source - you can verify all of it.
- It never sees private keys. The sensor reads what any TLS client sees during a handshake. Private keys of the scanned services stay on their hosts.
- It reads no application data. The handshake completes, the chain is read, the connection closes. No HTTP bodies, no mail contents, no payloads.
- It does not scan what you did not ask for. Beyond your target list it
takes on exactly one thing: the network its own interface sits in, bounded to
private address space in
/24or narrower - and only once somebody has confirmed that network in the Console. A machine that moves does not carry its permission with it. See automatic discovery.
Scan profiles
Section titled “Scan profiles”Concurrency is governed by a profile, and the default is deliberately timid - a discovery agent that takes down a customer network is a defect, not a performance feature.
| Profile | Concurrent connections |
|---|---|
conservative (default) |
16 |
standard |
64 |
aggressive |
256 |
Start with conservative. Raise it only after a full sweep has run cleanly and
you know how your network reacts.
Identity
Section titled “Identity”Each sensor holds its own mTLS client certificate, obtained once during install. Reports are attributed to that identity, which is how NextPKI knows which tenant - and which sensor - a finding came from. There is no shared API key across sensors.
Managed from the Console
Section titled “Managed from the Console”Once a sensor is registered you drive it from the Console, not the host. Its detail page under Sensors sets what it scans - targets, ports, filters, profile, interval - and a pause switch; the change reaches the sensor on its next check-in and it reconfigures live. The sensor also keeps its own binary current: it fetches signed releases and swaps itself, unless you turn that off. Both are covered in install and configuration.
Source and licensing
Section titled “Source and licensing”Source available, not open source. The sensor is licensed under the PolyForm Internal Use License 1.0.0 plus additional grants from Datargo GmbH. Please do not describe it as open source.
| You may | You may not |
|---|---|
| Read, review and audit the source | Redistribute the software |
| Publish review findings, including code excerpts | Sublicense or transfer your license |
| Build it yourself and run your own builds | Embed it in a product you supply |
| Run it for your own internal business operations | |
| Run it on a client’s behalf, if you are an MSP, integrator or NextPKI partner and that client is entitled to use NextPKI |
The full terms, including the exact wording of the additional grants, are in
LICENSE in the repository. For anything beyond the left column - redistribution
in particular - contact legal@datargo.com.
The point of publishing the source is that you do not have to trust what this page claims the sensor sends. You can check.