<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-certificate-transparency-abuse
description: >-
  Monitor Certificate Transparency logs to detect unauthorized certificate
  issuance, subdomain enumeration via CT data, phishing domain detection,
  and CA misissuance. Covers crt.sh queries, CT log APIs, and automated
  monitoring pipelines.
domain: cybersecurity
subdomain: cryptography
tags:
  - certificate-transparency
  - ct-logs
  - crt-sh
  - phishing-detection
  - subdomain-enumeration
  - ca-misissuance
  - monitoring
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1553.004"]
---

# Detecting Certificate Transparency Abuse

## Overview

Certificate Transparency (CT) is a public logging framework (RFC 6962) that
records all publicly trusted certificates. While CT improves trust, attackers
abuse it for reconnaissance (subdomain enumeration) and defenders must monitor
it for unauthorized certificate issuance. This skill covers both offensive
awareness and defensive monitoring.

## Prerequisites

| Requirement | Install |
|---|---|
| curl / jq | `apt install curl jq` |
| Python 3.10+ | For agent tooling |
| certstream (optional) | `pip install certstream` |

## Key Concepts

### CT Log Monitoring for Unauthorized Certs

```bash
# Query crt.sh for all certificates issued for a domain
curl -s "https://crt.sh/?q=%.example.com&output=json" | \
  jq -r '.[] | [.id, .name_value, .issuer_name, .not_before] | @tsv'

# Find recently issued certificates (last 7 days)
curl -s "https://crt.sh/?q=%.example.com&output=json" | \
  jq -r '[.[] | select(.not_before > (now - 604800 | strftime("%Y-%m-%dT%H:%M:%S")))]'

# Search for specific subdomain patterns
curl -s "https://crt.sh/?q=admin.%.example.com&output=json" | \
  jq -r '.[].name_value' | sort -u

# Check for wildcard certificates
curl -s "https://crt.sh/?q=*.example.com&output=json" | \
  jq -r '.[] | select(.name_value | contains("*"))'
```

### Subdomain Enumeration via CT

```bash
# Extract unique subdomains from CT logs
curl -s "https://crt.sh/?q=%.example.com&output=json" | \
  jq -r '.[].name_value' | sort -u | \
  sed 's/\*\.//g' | grep -v '^$' | sort -u

# Cross-reference with DNS resolution
curl -s "https://crt.sh/?q=%.example.com&output=json" | \
  jq -r '.[].name_value' | sort -u | while read domain; do
    ip=$(dig +short "$domain" 2>/dev/null | head -1)
    [ -n "$ip" ] && echo "$domain -> $ip"
  done
```

### Phishing Domain Detection

```bash
# Monitor for lookalike domains (typosquatting)
# Search for certificates containing your brand name
curl -s "https://crt.sh/?q=%examp1e%&output=json" | \
  jq -r '.[].name_value' | sort -u

# Real-time CT stream monitoring (Python certstream)
python3 -c "
import certstream
def callback(message, context):
    if message['message_type'] == 'certificate_update':
        domains = message['data']['leaf_cert']['all_domains']
        for d in domains:
            if 'example' in d.lower() and 'example.com' not in d:
                print(f'ALERT: {d}')
certstream.listen_for_events(callback, url='wss://certstream.calidog.io/')
"
```

### CA Misissuance Detection

Indicators of unauthorized certificate issuance:

| Indicator | Detection |
|---|---|
| Unknown CA issuer | Certificate from CA not in your approved list |
| Unexpected subdomain | Cert for subdomain you don't operate |
| Duplicate issuance | Multiple certs for same domain from different CAs |
| Pre-certificate without cert | SCT without matching certificate |

## Workflow

1. **Baseline** — Enumerate all legitimate certificates via crt.sh
2. **Monitor** — Set up real-time CT log monitoring for your domains
3. **Alert** — Flag certificates from unexpected issuers or subdomains
4. **Investigate** — Verify flagged certificates against DNS and infrastructure
5. **Respond** — Revoke unauthorized certs, contact CA if misissuance
6. **Enumerate** — Use CT data defensively to discover shadow infrastructure

## Verification

| Check | Method |
|---|---|
| All certs from approved CAs | crt.sh query filtered by issuer matches approved list |
| No rogue subdomains | CT subdomains match DNS inventory |
| Monitoring active | CT stream or scheduled crt.sh polling in place |
| Phishing domains flagged | Lookalike domain search returns known results only |
| CAA records set | `dig CAA example.com` shows authorized issuers |

## References

- [Certificate Transparency — RFC 6962](https://datatracker.ietf.org/doc/html/rfc6962)
- [crt.sh — Certificate Search](https://crt.sh/)
- [Google CT Policy](https://googlechrome.github.io/CertificateTransparency/)
- [Certstream — Real-time CT Feed](https://certstream.calidog.io/)
