The average mid-size organization has certificates from five to ten different sources. Let's Encrypt for the marketing site. AWS Certificate Manager for the API behind CloudFront. Cloudflare's edge certs for the front-end. DigiCert for the EV cert on the customer-facing checkout. Sectigo for the legacy admin portal. The internal CA for service-to-service mTLS. The vendor portal that issues a cert for the integration subdomain.
Each source has its own dashboard. Each dashboard is its own mental model. The certs that fall between them - the ones that aren't fully accounted for in any single inventory - are the ones that take production down.
The dashboard tax
Five sources means five dashboards. Five dashboards means five places to check, five sets of alerts to configure, five different conceptions of "healthy," and five separate audit trails that auditors have to stitch together when they ask "show me all the certs you have."
Operationally, this scales worse than linearly. The cost of monitoring N sources isn't N times the cost of monitoring one - it's the cost of building a mental map that connects what each source means, plus the ongoing tax of context-switching between them. The on-call engineer who's troubleshooting a TLS incident at 3am doesn't want to check five dashboards. They want one place to ask "what's the cert for this hostname, where does it live, what state is it in."
Most organizations don't actively decide to live with five dashboards. It accumulates. A team adopts Cloudflare for an edge use case. A different team uses AWS ACM because their workload is on EKS. A third team needs an EV cert and goes to DigiCert. Nobody's wrong; each decision was right in context. The system-level result is fragmented inventory.
Why CT log monitoring alone doesn't solve it
Certificate Transparency logs are the standard way to find publicly-issued certs for your domains. They cover the public-CA-issued part of your portfolio. They don't cover:
- Internally-issued certs (your k8s service mesh, Vault, internal CA) - not in CT.
- Cloud-managed certs that bypass CT for operational reasons - Cloudflare's older cert types, some Azure-managed certs.
- Vendor-portal-issued certs unless the vendor explicitly logs them.
- Pre-CT-mandate legacy certs from CAs that may have been issued without logging.
CT covers maybe two-thirds of an enterprise portfolio. The remaining third requires active inventory against each issuance source.
What consolidation actually requires
A unified certificate inventory has to satisfy four properties:
Source-agnostic. Every cert in one inventory, regardless of which CA, cloud, vendor, or internal system issued it. The inventory doesn't care about the source; it cares about the cert.
Continuously updated. New certs appear automatically. Decommissioned certs are detected (or at least flagged for review). The inventory reflects current state, not last quarter's snapshot.
Source-aware where it matters. The inventory knows where each cert came from, because that's what tells you who to escalate to when something needs renewal. A cert from AWS ACM has a different renewal owner than a cert from Sectigo.
Exportable. The audit team, the compliance team, the security team, and the platform team all need this data in different formats. Exportable to SIEM, exportable to CSV, exportable via API.
The operational payoff
Three things change when you consolidate.
Incident response gets faster. The on-call engineer asks "what cert is serving this hostname" and gets one answer, not "let me check Cloudflare, then ACM, then..." MTTR on cert-related incidents drops from hours to minutes.
Audit prep gets faster. The auditor asks "show me your TLS cert inventory" and you export from one source instead of stitching together five.
Coverage gets more honest. When everything lives in one inventory, gaps become visible. The team that's been using a fourth CA you didn't know about shows up. The shadow certs from a cloud account that didn't have inventory get surfaced. You learn what you actually have.
One inventory for the certs you actually have
TLS Radar consolidates certificates from public CAs, private CAs, cloud-managed services, vendor portals, and internal PKI into a single source-agnostic inventory. Continuous discovery, ownership tagging, exportable for audit and incident response. Built for enterprise teams with API integration, SAML/SSO, and pricing tailored to your certificate volume. Tell us what's currently in your stack.
Get the next post in your inbox
TLS monitoring tips and product updates. No spam, unsubscribe anytime.