Certificate Transparency Scanner
Monitors Certificate Transparency logs for unauthorized certificates.
What is Certificate Transparency?
Certificate Transparency (CT) is a system where Certificate Authorities must log all issued certificates to public, auditable logs. CT monitoring detects unauthorized certificate issuance for your domains, whether through CA compromise, mis-issuance, or malicious actors obtaining certificates for phishing or interception.
Why is This Important?
Attackers who obtain certificates for your domain can impersonate your services, intercept traffic, or conduct convincing phishing. CT monitoring provides early warning of such certificates. It's also useful for discovering forgotten subdomains, shadow IT, and certificate inventory management.
How It Works
1. Network Discovery
Scans and fingerprints network services, identifying open ports, protocols, and service versions.
2. Protocol Analysis
Tests protocol implementations for misconfigurations, weak encryption, and known vulnerabilities.
3. Infrastructure Assessment
Provides comprehensive network security posture with prioritized remediation recommendations.
Key Capabilities
Enterprise network security assessment covering infrastructure, protocols, and service configurations.
- Comprehensive port and service discovery
- Protocol-specific vulnerability checks
- TLS/SSL configuration analysis
- Legacy protocol detection and assessment
- Network segmentation validation
Frequently Asked Questions
How does Certificate Transparency work?
CAs must submit certificates to multiple CT logs before issuance. Browsers require Signed Certificate Timestamps (SCTs) proving CT submission. Anyone can query CT logs to find all certificates issued for a domain, enabling detection of unauthorized certificates.
What should trigger an alert from CT monitoring?
Alert on: certificates for domains you didn't request, certificates from unexpected CAs, certificates with unexpected Subject Alternative Names, wildcard certificates you didn't authorize, and certificates for internal/staging domains that shouldn't have public certs.
Can CT logs be used for reconnaissance?
Yes, CT logs reveal all subdomains with certificates, including internal services, staging environments, and shadow IT. Attackers use services like crt.sh to enumerate subdomains. This is a trade-off: transparency enables detection but also reconnaissance.
How do I implement CT monitoring?
Use services like: Facebook CT Monitor, crt.sh monitoring, Censys, or SSLMate's CT Search. Many certificate management platforms include CT monitoring. Configure alerts for your domains and regularly review new certificate issuances.
Related Scanners
Ready to secure your application?
Start testing for certificate transparency vulnerabilities today.
Get Started Free