Introduction

Nutanix Prism Element (PE) is the cluster-level management interface for Nutanix AHV/AOS environments. It provides the legacy PrismGateway REST APIs (v1 and v2.0), which are used to manage SSL/TLS certificates, Data-at-Rest Encryption (DARE), key management servers, SSH public keys, and SNMPv3 credentials for an individual cluster.

The Nutanix Prism Element Discovery Plugin connects directly to a single Prism Element endpoint to discover and catalog cryptographic assets within that cluster. It identifies and reports certificates, certificate authority (CA) chains, cryptographic keys, and security-sensitiveconfigurations, providing comprehensive visibility into the cluster's cryptographic posture.

Features

The plugin performs 15 discovery routines to identify and inventory cryptographic assets across the Prism Element cluster.

Certificates and Keys

  • Live TLS Certificate Capture: Establishes a TLS handshake with the Prism Element endpoint and captures the presented leafcertificate.
  • CA Chain Discovery: Retrieves the cluster CA certificate chain through /v1/keys/ca_chain, with /v1/keys/pem used as a metadatafallback.
  • File Server SSL Certificates: Discovers SSL certificates configured for Nutanix Files file servers (vFilers) through/v1/vfilers/{id}/ssl_certificate.
  • Cluster SSH Public Keys: Enumerates SSH public keys configured on the cluster.
  • Client Authentication (mTLS) CA Chain: Reports the CA configuration used for mutual TLS client authentication.

Encryption and Security

  • Data-at-Rest Encryption (DARE): Discovers DARE CA certificates, retrieves pending DARE CSRs, and reports encryption-related cluster information, including disk and container counts.
  • Encryption Status: Reports encryption configuration details and the number of enabled and disabled encryption instances.

Key and Authentication Management

  • Key Management Servers (KMS): Identifies configured Key Management Server entries and reports associated metadata.
  • SNMPv3 Keys: Discovers SNMPv3 users configured with authentication and privacy keys.
  • Authentication Configuration: Reports authentication settings, supported authentication methods, and configured LDAP directoryentries.
  • Remote Sites: Discovers remote site and disaster recovery (DR) configurations.

Configuration and Monitoring

  • HTTP Proxy Configuration: Reports configured HTTP proxies and associated CA certificates.
  • Syslog Configuration: Discovers TLS certificate settings used for secure syslog forwarding.

Output Format

The plugin uses a shared formatting framework (common/formatter and common/plugincli) to generate consistent, standards-compliantasset records. Certificate data is exported in a normalized format, with cert_pem values stored without embedded newline characters. Certificate metadata is derived directly from the PEM content and is not duplicated in the additional attributes section.