A certificate inventory built by scanning ourselves

An inventory of what is configured, compared against an inventory of what is actually listening.

# what we think we serve
./bin/configured-endpoints | sort > /tmp/configured

# what actually answers on 443, across our ranges
nmap -Pn -p443 --open -oG - "$RANGES" 
  | awk '/Ports:/{print $2}' | sort > /tmp/actual

comm -13 /tmp/configured /tmp/actual
# 2 addresses nobody could account for

Scanning your own address space is a thing that feels excessive until it finds a staging host from 2021 serving a copy of the application with real data. An inventory derived from configuration describes intent; the scan describes reality, and the gap between them is where every one of these incidents has lived.