CBOM generation: discovering algorithms, keys, protocols and certificates

A complete CBOM is assembled from several discovery methods, each of which sees a different slice of the estate. This guide covers what each method finds, what it misses and how to merge the results.

Start with scope

Before running any tool, decide what the CBOM describes: a single product release, an application in production, or the whole enterprise. A supplier producing a CBOM for a delivered product works mostly from code and build artefacts; an enterprise building an internal inventory works mostly from networks, infrastructure and key stores. CERT-In asks consumer organisations to create an internal CBOM aligned with supplier data (rec. 8.4.1.8), so in practice you need both views ^[11].

The NIST NCCoE's SP 1800-38 practice guide devotes a volume to the approach and architecture of public-key application discovery tools ^[1], and CISA's strategy expects automated discovery to be supplemented by manual collection where tools fall short ^[2].

Discovery methods compared

Network discovery

Scan TLS on all listening ports, not only 443, mail, directory, database and management interfaces often run older configurations. Nmap's ssl-enum-ciphers script enumerates every cipher suite a server accepts ^[3]; testssl.sh reports protocols, ciphers and a range of flaws with JSON or CSV output ^[4]. For SSH, ssh-audit lists key exchange, host-key, encryption and MAC algorithms ^[5]. Each result becomes a protocol asset with its version and cipher suites, a certificate asset, and algorithm assets for the key exchange and signature schemes. Scan from inside network segments as well as from the internet.

Source-code discovery

Static analysis finds cryptographic API calls and the parameters passed to them. The sonar-cryptography plugin covers Java (JCA and Bouncy Castle), Python (pyca/cryptography) and Go, and writes a CycloneDX 1.6 CBOM including the file locations where each asset was detected ^[6]. cdxgen offers a cbom mode covering Java keystores and certificates and JavaScript and TypeScript source ^[7]. Run these in CI so each release has a CBOM, and record the evidence location, it is what developers need to fix a finding.

Binary, container and file-system discovery

Deployment artefacts contain cryptography that source code does not show: bundled OpenSSL builds, trust stores, embedded private keys and TLS configuration files. cbomkit-theia detects certificates, keys, secrets and configuration files in container images and directories ^[8]. Pair this with your SBOM, which already records library versions, so that a vulnerable cryptographic library can be traced to every image that ships it.

HSM, KMS and PKI

Keys held in hardware security modules and cloud key services are best inventoried from the source of truth. HSMs commonly expose key objects and their attributes through the OASIS PKCS #11 interface ^[9]; cloud KMS services expose key metadata through their management APIs. Export key identifier, algorithm, size, state, creation and activation dates, the fields CERT-In lists for keys ^[11]and tag each key with the application that uses it. From your PKI and certificate management systems, export issued certificates with subject, issuer, validity and signature algorithm.

Merge into one CBOM

1. Normalise each result into a CycloneDX cryptographic-asset component with the right assetType: algorithm, certificate, protocol or related-crypto-material ^[10].
2. Deduplicate by stable identifiers, certificate fingerprint, key ID, algorithm name plus parameters.
3. Link certificates to their signature algorithm and public key, protocols to their cipher suites, and assets to the software components and services that use them.
4. Attach owners and business context.
5. Validate against the schema and required fields before publishing; see CBOM validation.

Make it repeatable

A CBOM generated once is out of date within weeks. Run code scans on every build, network scans on a schedule, and key and certificate exports at least as often as CERT-In's recommended quarterly review ^[11]. Keep every version so you can see what changed; see CBOM management.

How IntelliXBOM helps

IntelliXBOM generates and ingests CBOMs in CycloneDX, bringing results from different discovery methods into one versioned inventory. It validates each CBOM against required-field policies, shows diffs between versions, and correlates cryptographic assets with vulnerabilities and the business services they support.