How does Certificate Transparency monitoring reveal hidden infrastructure?
Certificate Transparency (CT) is a public logging framework defined in RFC 6962 that requires Certificate Authorities to publish every SSL/TLS certificate they issue to append-only, cryptographically verifiable logs. Max Intel's CT Monitor queries crt.sh, a CT log search engine maintained by Sectigo that indexes certificates from all major CT logs. Each certificate's Common Name (CN) and Subject Alternative Name (SAN) fields list the hostnames it covers — revealing subdomains that may not appear in DNS records, search engine results, or active web crawls. According to the OWASP Testing Guide v4.2, CT log analysis is a recommended passive reconnaissance technique because it discovers infrastructure the target organization may not realize is publicly visible.
Why are internal hostnames in CT logs a security risk?
Organizations frequently obtain SSL/TLS certificates for internal services — staging servers, CI/CD pipelines, monitoring dashboards, VPN endpoints, and database servers. These certificates appear in CT logs alongside public-facing certificates, exposing internal naming conventions and infrastructure topology. The SANS Institute attack surface mapping methodology identifies CT log enumeration as a critical step because internal hostnames like jenkins.corp.example.com, grafana.internal.example.com, or db-master-01.example.com reveal the specific technologies and architecture an organization uses — information that significantly reduces the effort required for targeted attacks.
What do the five analysis views reveal?
The Certificates table shows every certificate with issuer, validity dates, and SAN count — sortable and filterable by active, expired, wildcard, or internal status. The Subdomains view deduplicates hostnames across all certificates, showing first-seen and last-seen dates that indicate how long each subdomain has existed. The Domain Tree visualizes the subdomain hierarchy as a collapsible tree structure, making organizational patterns visible at a glance. The Timeline chart plots certificate issuance and expiration periods for the top 40 subdomains, revealing certificate rotation patterns and gaps. The Issuers view shows which Certificate Authorities the organization uses, which can indicate vendor relationships, automation practices (Let's Encrypt suggests automated provisioning), or enterprise CA deployments.
- Certificate Transparency (CT)
- A public logging framework (RFC 6962) requiring Certificate Authorities to publish every issued certificate to append-only logs, enabling domain owners and researchers to detect misissued or unauthorized certificates.
- Subject Alternative Name (SAN)
- An X.509 certificate extension that allows a single certificate to cover multiple hostnames. SAN fields are the primary source of subdomain discovery in CT log analysis, as modern certificates list all covered domains here rather than in the Common Name field.
- crt.sh
- A free CT log search engine operated by Sectigo (formerly Comodo CA) that indexes certificates from all major Certificate Transparency logs, providing a JSON API for programmatic queries by domain name.
- Wildcard Certificate
- A certificate that uses an asterisk (e.g.,
*.example.com) to cover all subdomains at one level of a domain. Organizations using wildcard certificates expose fewer specific hostnames in CT logs compared to those using individual certificates per subdomain.