IPs, certificates and software

Routing and registry data of public addresses, the certificate store and the software inventory.

IPs

IPs groups every address by announced prefix and origin AS (RIPEstat), with registration data from the responsible RIR via RDAP (RIPE NCC, ARIN, APNIC, LACNIC, AFRINIC): network name, organisation, country, abuse contact.

• New public addresses are enriched in the background (queue).
• asterion:rir-refresh runs daily at 04:15 and refreshes data older than POLARIS_RIR_REFRESH_HOURS (24): up to 2000 addresses per run, queued 3 seconds apart to stay polite towards the registries.
• Changes of registry or routing data are recorded and sent as rir.changed.
• Private and special addresses are never looked up.
• An AS page lists the addresses of that AS.

Certificate store

Every certificate is stored once (SHA-256, PEM). For every endpoint Polaris records which certificate it serves per SNI name — all known hostnames of the host plus the default certificate of the bare IP — and via STARTTLS (SMTP, FTP, IMAP, POP3), seen from which satellite.

• Checks: validity and remaining days, chain trust, hostname match, revocation (OCSP, then CRL), protocol, key and signature algorithm.
• A different certificate on an endpoint is a change (cert.changed).
• SAN names that resolve to the host become hostnames of the host; SANs of other domains are filed in the domain catalog.
• Wildcard certificates are stored as patterns on the domain — never as hosts, never used to merge hosts.

On a bare IP the HTTPS and certificate checks use a known name of the host (or its confirmed PTR name) as SNI; without one, only the chain is checked, not the name.

Software versions

Every product and version seen on a service — nmap -sV, SMTP and FTP banners, the HTTP Server header — with first and last seen. Software lists the inventory of the tenant.