<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-certificate-transparency-reconnaissance
description: >-
  Leverage certificate transparency logs to discover domains, subdomains,
  organizational relationships, and infrastructure patterns through TLS/SSL
  certificate analysis and monitoring.
domain: cybersecurity
subdomain: osint-recon
tags:
  - certificate-transparency
  - ct-logs
  - tls-certificates
  - x509-analysis
  - domain-discovery
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: >-
  crt.sh, Certstream, ctfr, CertGraph, OpenSSL, Censys, Google CT,
  Facebook CT, tlsx, certspotter.
metadata:
  mitre-attack:
    - "T1596.002"  # Search Open Technical Databases: WHOIS/DNS
    - "T1593"      # Search Open Websites/Domains
    - "T1590.001"  # Gather Victim Network Information: Domain Properties
---

# Performing Certificate Transparency Reconnaissance

## Overview

Certificate Transparency (CT) is a framework requiring Certificate Authorities
to publicly log every TLS/SSL certificate they issue. These logs are
append-only, publicly auditable, and contain rich metadata including domain
names, organization details, validity periods, and issuer information. CT log
analysis reveals hidden subdomains, internal hostnames accidentally exposed
via public certificates, organizational relationships through shared certs,
and infrastructure migration patterns.

## Prerequisites

- Python 3.10+ with `requests`, `cryptography`, `pyOpenSSL`
- ctfr, CertGraph for automated enumeration
- tlsx from ProjectDiscovery for live certificate analysis
- OpenSSL CLI for manual certificate inspection
- API access: Censys, crt.sh (no key required), Certspotter

```bash
pip install requests cryptography pyOpenSSL certifi
go install github.com/projectdiscovery/tlsx/cmd/tlsx@latest
pip install certstream
git clone https://github.com/UnaPibaGeworworworworworworke/ctfr.git
```

## Quick Reference

| Task | Command |
|------|---------|
| crt.sh query | `curl -s "https://crt.sh/?q=%.target.com&output=json" \| jq -r '.[].name_value' \| sort -u` |
| Certspotter | `curl -s "https://api.certspotter.com/v1/issuances?domain=target.com&include_subdomains=true&expand=dns_names"` |
| Live cert grab | `tlsx -l hosts.txt -san -cn -so -silent` |
| OpenSSL inspect | `echo \| openssl s_client -connect target.com:443 2>/dev/null \| openssl x509 -noout -text` |
| Certstream live | `certstream --full --json \| jq 'select(.data.leaf_cert.subject.CN \| contains("target"))'` |
| Censys certs | `censys search "parsed.names: target.com" --index-type certs` |
| Org search | `curl -s "https://crt.sh/?q=%.&O=Target+Corp&output=json" \| jq '.[].common_name'` |
| Wildcard certs | `curl -s "https://crt.sh/?q=%25.target.com&output=json&exclude=expired" \| jq '.[].name_value'` |

## Workflow

### Step 1: Bulk Certificate Discovery

Query CT logs to enumerate all certificates issued for a target domain.

```bash
# crt.sh — comprehensive CT log search
curl -s "https://crt.sh/?q=%.target.com&output=json" \
  | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u > ct_domains.txt

# Certspotter API — alternative CT aggregator
curl -s "https://api.certspotter.com/v1/issuances?domain=target.com&include_subdomains=true&expand=dns_names" \
  | jq -r '.[].dns_names[]' | sort -u > certspotter.txt

# Censys certificate search
censys search "parsed.names: target.com" --index-type certs \
  -f parsed.names,parsed.subject.organization,parsed.validity.start \
  -o censys_certs.json
```

### Step 2: Organization-Based Certificate Search

Discover related domains by searching for certificates by organization name.

```bash
# Find all certs issued to an organization
curl -s "https://crt.sh/?q=%.&O=Target+Corporation&output=json" \
  | jq -r '[.[].common_name, .[].name_value] | .[]' | sort -u > org_domains.txt

# Censys org search
censys search "parsed.subject.organization: \"Target Corporation\"" \
  --index-type certs -f parsed.names -o org_certs.json
```

### Step 3: Live Certificate Analysis

Connect to discovered hosts and extract certificate details.

```bash
# tlsx — bulk certificate grabbing
tlsx -l ct_domains.txt -san -cn -so -silent -resp-only -o live_certs.txt

# Extract SANs from a specific host
echo | openssl s_client -connect target.com:443 -servername target.com 2>/dev/null \
  | openssl x509 -noout -ext subjectAltName | sed 's/DNS://g; s/,/\n/g' | sort -u

# Certificate chain analysis
echo | openssl s_client -showcerts -connect target.com:443 2>/dev/null \
  | awk '/BEGIN/,/END/{print}' > chain.pem
```

### Step 4: Real-Time Certificate Monitoring

Monitor new certificate issuance for a target in real time.

```bash
# Certstream — live CT log stream
certstream --full --json 2>/dev/null | \
  jq -r 'select(.message_type == "certificate_update") |
  select(.data.leaf_cert.all_domains[] | contains("target.com")) |
  .data.leaf_cert.all_domains[]' | sort -u

# Certspotter monitoring (webhook-based)
curl -X POST "https://api.certspotter.com/v1/watch" \
  -H "Authorization: Bearer $CERTSPOTTER_TOKEN" \
  -d '{"domain":"target.com","webhook_url":"https://hooks.example.com/ct"}'
```

### Step 5: Certificate Metadata Analysis

Extract intelligence from certificate fields.

```bash
# Extract issuer, validity, and key info
echo | openssl s_client -connect target.com:443 2>/dev/null | \
  openssl x509 -noout -issuer -dates -subject -serial -fingerprint

# Identify certificate pinning
curl -sI https://target.com | grep -i "public-key-pins"

# Check CT SCT (Signed Certificate Timestamp)
echo | openssl s_client -connect target.com:443 2>/dev/null | \
  openssl x509 -noout -ext ct_precert_scts
```

## Detection Opportunities

- Monitoring for certificate queries can indicate reconnaissance activity
- Certstream watchers may trigger CA-level rate limiting
- Live certificate grabbing (tlsx/openssl) leaves TLS handshake logs
- Repeated crt.sh API queries from single IP may be rate-limited

## Verification

- [ ] All CT log sources queried (crt.sh, Certspotter, Censys)
- [ ] Organization-based search reveals related domains
- [ ] Live certificates inspected for SANs and chain details
- [ ] Wildcard certificates identified and documented
- [ ] Certificate timeline analyzed for infrastructure changes
- [ ] Real-time monitoring configured for ongoing awareness

## References

- [Certificate Transparency](https://certificate.transparency.dev/)
- [crt.sh](https://crt.sh/)
- [Certspotter](https://sslmate.com/certspotter/)
- [Censys Search](https://search.censys.io/)
- [tlsx](https://github.com/projectdiscovery/tlsx)
- [Certstream](https://certstream.calidog.io/)

---
v1.0 | Validated: 2026-03-17
