The Problem
Certificate expiries cause outages and silent trust failures — and most teams find out when something breaks. The renewal that slipped through the cracks takes down a customer-facing service at 2 a.m., and the post-mortem always says the same thing: "we didn't know it was expiring."
What It Does
Certania pulls every certificate expiring within the next 12 months, maps each one to the assets that carry it, and lays the whole picture out on two visual heat maps — so renewal work is planned by month, not discovered by outage. Expiring certs become gated Cert failure tags your team can route and track.
Key Capabilities
- 12-month expiry inventory — every certificate expiring in the next year, each mapped to the assets that carry it.
- Dual heat maps — issuer × asset and month × asset views turn the renewal backlog into a readable calendar.
- Gated "Cert failure:<date>" tagging — each expiring cert becomes a dated, routable work item with an owner and a deadline.
- IoT/app device cache — devices revealed in certificate metadata are captured and shared with the pack.
How It Works
Runs against the local navi.db built from your Tenable data: the certs table for expiry, issuer, and subject data, joined with vulns for asset mapping. All writes are proposed, human-approved, and logged.
Who It's For
PKI owners who need a renewal calendar; ops and SRE teams tired of expiry-driven incidents; vulnerability management teams closing the trust gap.
Proof Points
In a 268-asset reference environment, Certania's cert inventory fed Heimdall's finding that ~100% of certificates were quantum-vulnerable — including certs valid to 2070 and 2114 that no manual review had flagged.
Works Better With
Feeds Heimdall (its cert inventory is the foundation of post-quantum risk classification) and Cerberus (its cert-derived device cache finds unmanaged IoT at the edge).
Why It's Different
- Heat maps, not a list — a renewal calendar you can read in ten seconds, grouped by issuer and month.
- Doubles as a pack data source — the same cert inventory powers Heimdall's quantum analysis and Cerberus's IoT discovery.
- Dated, gated tags — "Cert failure:<date>" turns an expiry into an assigned task, approved before it's written.