What the sensor does
The NextPKI sensor is a single static binary that runs inside your network, finds TLS certificates and reports their metadata. It exists because the certificates that hurt you are the ones nobody wrote down: the expired one on an appliance, the self-signed one on a printer, the forgotten host still serving traffic.
What it finds
Section titled “What it finds”| Mode | Protocols |
|---|---|
| Direct TLS | HTTPS, SMTPS (465), IMAPS (993), POP3S (995) |
| STARTTLS upgrade | SMTP (25, 587), IMAP (143), POP3 (110) |
Targets can be single hosts, host:port pairs, or IPv4 CIDR ranges, with
include and exclude lists. For each service that completes a handshake, the
sensor extracts the certificate chain, fingerprint, issuer, subject, SANs and
validity window.
What it does not do
Section titled “What it does not do”This list is the point of publishing the source - you can verify all of it.
- It never sees private keys. The sensor reads what any TLS client sees during a handshake. Private keys of the scanned services stay on their hosts.
- It reads no application data. The handshake completes, the chain is read, the connection closes. No HTTP bodies, no mail contents, no payloads.
- It does not scan what you did not ask for. There is no opportunistic sweeping beyond the configured target list.
Scan profiles
Section titled “Scan profiles”Concurrency is governed by a profile, and the default is deliberately timid - a discovery agent that takes down a customer network is a defect, not a performance feature.
| Profile | Concurrent connections |
|---|---|
conservative (default) |
16 |
standard |
64 |
aggressive |
256 |
Start with conservative. Raise it only after a full sweep has run cleanly and
you know how your network reacts.
Identity
Section titled “Identity”Each sensor holds its own mTLS client certificate, obtained once during install. Reports are attributed to that identity, which is how NextPKI knows which tenant - and which sensor - a finding came from. There is no shared API key across sensors.
Source and licensing
Section titled “Source and licensing”Source available, not open source. The sensor is licensed under the PolyForm Internal Use License 1.0.0 plus additional grants from Datargo GmbH. Please do not describe it as open source.
| You may | You may not |
|---|---|
| Read, review and audit the source | Redistribute the software |
| Publish review findings, including code excerpts | Sublicense or transfer your license |
| Build it yourself and run your own builds | Embed it in a product you supply |
| Run it for your own internal business operations | |
| Run it on a client’s behalf, if you are an MSP, integrator or NextPKI partner and that client is entitled to use NextPKI |
The full terms, including the exact wording of the additional grants, are in
LICENSE in the repository. For anything beyond the left column - redistribution
in particular - contact legal@datargo.com.
The point of publishing the source is that you do not have to trust what this page claims the sensor sends. You can check.