Discovery and Existing Deployments

Verify a managed parent domain

1. Open Organisation → Managed parent domains and add the parent domain you are authorised to manage.
2. Open Discovery, select that domain, and copy its TXT name and value into the authoritative DNS zone.
3. Choose Verify DNS ownership. Wait for the DNS record to become visible if verification fails. Domain-wide enumeration remains unavailable until proof succeeds.

Verify only domains controlled by your organisation. Adding a parent domain does not request certificates or change deployments.

Discover domain names and review evidence

1. Choose the verified parent domain. Select the entire domain or enter a CIDR boundary to constrain results.
2. Choose Run domain discovery and then View discovered names.
3. Review Certificate Transparency records, live TLS observations and certificate diagnostics for each name. Confirm ownership and the endpoint before creating automation.

CIDR filtering retains discovered names whose resolved addresses fall within the boundary; it does not scan that range. Observed certificate history can include expired or replaced certificates. Discovery evidence alone does not establish that a certificate is currently deployed.

Discover existing certificate deployments

Use Network Discovery for systems and ranges you are permitted to inspect. Configure the range and connection information shown by the form, run discovery, and review its results before importing anything.

A discovered endpoint is evidence, not an instruction to replace its certificate. Confirm the application, hostname, certificate binding and selected deployment target. See deployment target registration for its connection and CA settings.

Choose the next action

To retain a supplied certificate and key, use Import certificate. To issue and renew a new certificate, use Create certificate automation. To observe an endpoint without deploying to it, use SSL Monitoring. Removing an inventory entry does not prove that a remote certificate was removed.