Detect certificates

Beta feature

This feature is currently available as a beta release. Beta functionality is stable but possibly incomplete and subject to change. We strongly discourage using beta features with production workflows, as features may not function seamlessly and you may encounter unexpected issues.

Vault Radar scans for PEM-encoded certificates and evaluates their cryptographic properties to identify risky or misconfigured certificates. This page describes what Vault Radar detects, which risk tags it assigns, and how severity is determined.

What Vault Radar detects

Vault Radar identifies PEM blocks with the following headers:

For a multiline certificate, the detector requires a matching PEM end boundary, Base64 content, at least 100 Base64 characters, and an entropy confidence of at least 0.5. Placeholder, malformed, truncated, quoted, or low-entropy values are suppressed.

For X.509 certificate PEM blocks, Vault Radar parses the certificate and evaluates its signing algorithm, RSA key size, validity, and self-signed status. A valid X.509 certificate with no assigned risk tags is suppressed. Certificates are public artifacts by design, so their presence alone is not a finding.

PKCS#7 bundles are detected but not parsed for X.509 risk tags. If a PKCS#7 block passes detection validation, it is reported without certificate-risk tags. Because an untagged secret-category finding falls through to the default severity rule, it is displayed with Medium severity.

Certificate risk tags

A certificate can receive more than one tag. Each tag represents one property observed in the parsed certificate.

Tag	Assigned when	Security meaning
`insecure_signing_algorithm`	The signature algorithm is `MD5WithRSA`, `SHA1WithRSA`, `ECDSAWithSHA1`, or `DSAWithSHA1`.	The signing algorithm is cryptographically broken.
`insecure_key_size`	The certificate contains an RSA public key smaller than 1024 bits.	The RSA key is critically weak.
`weak_signing_algorithm`	The signature algorithm is `DSAWithSHA256`.	DSA is deprecated but not classified as an actively broken algorithm.
`weak_key_size`	The certificate contains an RSA public key from 1024 through 2047 bits.	The RSA key is below the 2048-bit industry baseline.
`expired_certificate`	The certificate is expired, or it expires in fewer than 30 whole days.	The certificate is no longer valid or needs prompt renewal.
`self_signed_certificate`	The subject distinguished name equals the issuer distinguished name.	The certificate has no distinct issuing CA identity.

Severity mapping

Vault Radar derives one displayed severity from all tags on the finding. The highest applicable certificate severity wins.

Displayed severity	Tags that cause it
Critical	`insecure_signing_algorithm`, `insecure_key_size`
High	`weak_signing_algorithm`, `weak_key_size`, `expired_certificate`
Medium	`self_signed_certificate`

Examples

A SHA-1-signed certificate that is also expired receives insecure_signing_algorithm and expired_certificate. Its displayed severity is Critical.
An expired self-signed certificate receives expired_certificate and self_signed_certificate. Its displayed severity is High.
A self-signed certificate with no other risk tag has Medium severity.
An RSA-2048 certificate using SHA-256, with more than 30 days remaining and a different subject and issuer, has no certificate-risk tags and is not reported as a finding.

Severity precedence rules

Severity selection is rule-based, not tied to any single tag. The rules are evaluated in this order:

ignore_rule, inactive_secret, and certain general suppression tags produce Info before certificate severity is evaluated.
Critical certificate tags take precedence over High and Medium certificate tags.
High certificate tags take precedence over the Medium self-signed tag.
The self-signed tag produces Medium only when no higher-priority certificate tag applies.

As a result, the expiry tag is not treated specially: it is one of the High-severity certificate tags, and any Critical tag wins over both High and Medium.

Conditions that do not receive a risk tag

The following certificate properties do not trigger a risk tag:

RSA keys of 2048 bits or larger.
SHA256WithRSA, SHA384WithRSA, and ECDSAWithSHA256 signing algorithms.
PureEd25519 signatures.
Certificates with 30 or more whole days until expiry.
Certificates whose subject and issuer distinguished names differ.