Discovery is fragmented
Cloud inventories miss certificates embedded in workloads; filesystem scans miss the cloud service, identity or application that gives each asset meaning.
Certificate Intelligence · Built on Skyreach Orion
Know what will expire, who owns it and what depends on it.
Build a connected inventory of certificates and cryptographic keys across cloud and workload sources. Prevent expiry surprises, expose ownership gaps and turn post-quantum readiness into an evidence-based migration plan.
InventoryCertificates & keysOwnershipPeople & servicesReadinessExpiry & PQC
api.skyreach.exampleExpires in 12 daysOwner missing
payments-signingRSA-2048 · long-livedQuantum-vulnerable
workload-identityManaged lifecyclePlatform managed
The challenge
A certificate list does not tell you who needs to act
Cryptographic assets are spread across app registrations, cloud services, workload disks, key stores and appliances. Expiry dates alone do not explain service impact, renewal ownership or the scale of post-quantum migration.
Ownership is unclear
A renewal alert without an accountable person, team or owning service creates a ticket that can still become an outage.
Quantum readiness needs context
Knowing an algorithm is vulnerable is only the start. Migration depends on lifespan, dependencies, exposure and which systems can change together.
The product
From cryptographic discovery to an owned plan
Certificate Intelligence uses Orion's ontology to connect every discovered asset to the identities, workloads, services and owners around it.
Inventory and discovery
Bring certificates and keys from supported cloud and workload sources into one consistent inventory while preserving provenance.
- X.509 certificates and SSH keys
- Cloud identity and service certificates
- Agentless discovery from authorised VM disks
Ownership and accountability
Derive ownership from the application, identity and organisational relationships already represented in Orion.
- Owners linked to certificates and holders
- Unowned assets surfaced for action
- Service and workload context retained
Expiry and lifecycle
Find expired and expiring certificates, distinguish managed lifecycle from customer action and focus renewal work where interruption is possible.
- Upcoming expiry and days remaining
- Long-lived certificate detection
- First-class findings and remediation status
Post-quantum readiness
Classify algorithms and key strength, identify long-lived quantum-vulnerable cryptography and plan migration using real dependencies.
- Current weakness and PQC status
- Expiry-year and lifetime analysis
- Cloud TLS and key-policy posture
Post-quantum readiness
Turn a cryptographic census into a migration sequence
Orion separates cryptography that is weak today from cryptography expected to be vulnerable to a sufficiently capable quantum computer. It highlights long-lived assets that may survive normal renewal cycles and connects them to the services that must migrate.
- Certificates and SSH keys discovered on authorised VM disks
- Cloud TLS policies and key algorithms assessed
- Weak, transitional and quantum-vulnerable assets separated
- Ownership and dependency context available for planning
How it works
Discovery becomes intelligence when the relationships are added
Any connector that maps certificates or keys into Orion can feed the product. Certificate Intelligence then links holders, owners, workloads and services before applying lifecycle and quantum-readiness analysis.
Supported sourcesCloud identities · services · VM disks · key stores
→Crypto inventoryType · issuer · subject · algorithm · validity
→
Orion relationshipsHolder · owner · workload · dependencyCertificate IntelligenceExpiry · ownership · weakness · PQC plan
Ownership
Every renewal and migration needs someone accountable
Certificate Intelligence relates a cryptographic asset to the identity or service that holds it, then uses Orion's organisational relationships to identify the people responsible. Unowned certificates remain visible as a distinct operational risk.
Certificatebelongs toApp or servicemanaged byOwner
- Ownership dashboardCertificates per owner and each owner's next expiry.
- Unowned inventoryAssets with no accountable identity, ordered by urgency.
- Renewal contextHolder, expiry, lifetime and post-quantum status in one view.
- Managed lifecycle awarenessPlatform-managed certificates are counted without creating unnecessary findings.
Certificate Intelligence questions
What is discovered, how ownership works and how the product supports post-quantum planning.
What cryptographic assets can Orion represent?
The product is designed around certificates and keys, including X.509 certificates and SSH key material discovered through supported sources. Coverage depends on the connectors and scanning options enabled for your environment.
Does Orion copy raw VM disks?
No. Where agentless disk scanning is enabled, temporary snapshots and scanning resources are used within the authorised cloud workflow. The product receives structured findings and cryptographic metadata rather than retaining raw disk contents.
How is ownership determined?
Orion connects a certificate to the identity, application or service that exposes it, then follows management and ownership relationships to the responsible person or team. Assets without a reliable owner are kept in an explicit unowned view.
Does post-quantum status mean a certificate is insecure today?
Not necessarily. The product distinguishes cryptography that is weak today from conventional algorithms expected to be vulnerable to future quantum attack. Lifespan and dependency context help determine migration priority.
Turn certificate sprawl into an owned plan
Start with the cloud, identity and workload sources where expiry or cryptographic visibility matters most.