Inventory

Ecurem CLM combines certificate and domain inventory with a dedicated cryptographic inventory to provide an actionable view of assets, expirations, risk and post-quantum readiness.

1. Two complementary inventories

Inventory provides operational visibility into X.509 certificates and domains. Cryptographic Inventory extends that view with cryptographic mechanisms observed within the organization scope.

Open Cryptographic Inventory documentation.

2. Certificates

The Certificates view tracks known or discovered certificates, their state, issuer, validity period, expiration and available cryptographic information.

Depending on collected evidence, a record can include subject, issuer, serial number, fingerprint, algorithms, public-key type and size, and observed TLS context.

Use this view before Renewal to confirm the certificate, domain and organization actually involved.

3. Domains

The Domains view lists known domains and their state. A tracked domain does not automatically imply that a certificate should be renewed.

Discovery can enrich this scope from network and TLS observations performed within an authorized boundary.

4. Cryptographic Inventory

Cryptographic Inventory represents observations that support crypto-agility. Depending on source and available evidence, an asset may describe algorithms, protocols, libraries, keys, key sizes, TLS characteristics, risk level and classical, hybrid or post-quantum classification.

5. Risk and quantum posture

Cryptographic Inventory indicators and filters can isolate quantum-vulnerable assets, quantum-resistant assets, weak keys, obsolete protocols and low-to-critical risk levels when available evidence supports that conclusion.

These indicators support prioritization; they do not replace a complete compliance assessment of the system using the asset.

6. Observation sources

Network/TLS Discovery primarily provides visibility into observed services and certificates. Discovery Agent extends that visibility into internal networks.

When local cryptographic discovery is enabled, Discovery Agent can produce a sanitized CycloneDX 1.7 CBOM and submit it to Ecurem CLM. The server then validates and normalizes those observations into the organization’s Cryptographic Inventory.

7. Recommended workflow

1. Define the organization and authorized scope.
2. Add or import the required domains.
3. Run Discovery for reachable services and certificates.
4. Use Discovery Agent for internal environments.
5. Review certificates in Inventory and crypto observations in Cryptographic Inventory.
6. Prioritize expirations, risk and post-quantum readiness.
7. Configure Renewal only for certificates that are actually managed.
8. Use Reports and Compliance to document posture and actions.