Abstract: An embodiment includes executing a discovery pattern for the certificate authority, where the discovery pattern contains instructions for obtaining one or more digital certificates from the certificate authority; obtaining, from the certificate authority, a representation of a digital certificate acquired by a managed network from the certificate authority; storing, in a first set of mappings, a first new mapping between the certificate authority and the digital certificate; receiving, from a computing device disposed with the managed network, an indication that the digital certificate is installed on the computing device;, storing, in a second set of mappings, a second new mapping between the digital certificate and the computing device; determining that the digital certificate is expired; and storing, in a third set of mappings, a third new mapping between the digital certificate and a critical status indicator.