Container platforms multiply certificate sprawl: every image layer can ship its own trust store, every workload can mount its own TLS secret, and base images pulled last year may embed CA certificates that expired months ago. TigerTrust’s container scanning turns that mess into an inventory.

​
What it is

You register container targets (a registry, a Docker daemon, or a Kubernetes cluster), kick off a scan, and TigerTrust discovers every certificate it can find — parsing PEM, DER, PKCS#12, JKS, and BKS formats in image layers and mounted secrets. Discovered certificates appear in the same staging area as network scan results, ready for review and import.

​
When to use it

  • Find expired CA certificates embedded in base images before they cause handshake failures.
  • Inventory all kubernetes.io/tls secrets across a multi-namespace cluster.
  • Detect certificates mounted via Docker bind mounts or secrets that nobody is tracking.
  • Get visibility into which container images carry which certificates.

​
Three target types

Container registry

Docker Hub, Harbor, ECR, GCR, ACR, or any Registry v2-compatible endpoint. Scans image layers for certificate files and expired trust anchors.

Docker daemon

Points at a live Docker socket. Enumerates running containers and inspects their filesystem for certificates mounted via bind or secret.

Kubernetes cluster

Lists kubernetes.io/tls secrets across all namespaces (or a scoped subset) and parses the tls.crt field.

​
Set it up

1

Open container scanning

Go to Discovery > Container and click Add target.
2

Register a target

Choose the target type (registry, Docker, or Kubernetes), enter the endpoint URL, and provide credentials. For Kubernetes targets, paste a kubeconfig or use an in-cluster agent service account. Credentials are stored encrypted.
3

Enable the target

Toggle Enabled on the target row. Disabled targets are visible but excluded from scans.
4

Run a scan

Click Scan now on the target, or select a field agent to route the scan through. The scan creates a discovery job and populates results in Discovery > Results.
5

Review and import

Review the discovered certificates in Discovery > Results filtered to this scan. Select the certificates you want to track and click Import to add them to your managed inventory.

​
What you’ll see

Each discovered certificate row includes the image reference or Kubernetes path where the certificate was found, the parsed subject and SANs, expiry date, and an imported flag. The target list shows the last scan timestamp and discovered certificate count per target.
The Kubernetes scan requires get, list, and watch permissions on secrets and ingresses. A minimal ClusterRole is documented in Kubernetes management.
Registry scans can be I/O-heavy on large registries. Set a maximum images-per-repository limit on the target and schedule scans off-hours to avoid impacting registry performance.

Kubernetes management

Full cluster onboarding, cert-manager wiring, and secret writeback.

Cloud integrations

Discover certificates in AWS ACM, Azure Key Vault, and GCP Certificate Manager.

Discovery

How scans are dispatched, tracked, and imported.