domains / families / security / auditing-tls-certificate-transparency-logs

auditing-tls-certificate-transparency-logs

separate

'Monitors Certificate Transparency (CT) logs to detect unauthorized certificate

When to use

• Monitoring owned domains for unauthorized or unexpected certificate issuance by unknown Certificate Authorities
• Discovering subdomains and hidden services through certificates logged in public CT logs
• Detecting phishing infrastructure that uses look-alike domain certificates (typosquatting, homograph attacks)
• Auditing Certificate Authority compliance by verifying all issued certificates appear in CT logs as required by browser policies
• Building continuous certificate monitoring into a security operations pipeline with alerting for new issuances

When not to use

• attacking or disrupting Certificate Authorities
• scraping CT logs in violation of rate limits or terms of service
• sole method of subdomain enumeration without DNS verification

Skill page

Source