Regjistrat e Transparencës së Certifikatave

Certificate Transparency (CT) is a public append-only log of every TLS certificate issued by a participating certificate authority.

Every major CA — Let's Encrypt, DigiCert, Sectigo — is required to publish issued certificates to CT logs, which are public and searchable via tools like crt.sh and Censys. For an OSINT investigator, this means you can enumerate all subdomains of a target organization by querying CT for *.targetcompany.com and watching what certificates appear. Subdomains that would never appear in a DNS zone transfer or public documentation — internal staging, VPN, old dev boxes — often pop up because someone requested a TLS cert for them. Once you have a list of subdomains, the next step is infrastructure mapping: which IPs they resolve to, what technologies they run (Wappalyzer, BuiltWith), whether any are exposed to the internet, whether any reply on standard ports with unusual banners. Tools like amass and subfinder automate this and combine CT with other sources: Shodan, Censys, passive DNS databases, Google dorks. Defenders can use the same techniques to audit their own attack surface. A monthly CT watch alerts you when a new certificate is issued for your domain — which can be an early warning of a rogue CA or a legitimate new service you forgot to inventory. External Attack Surface Management (EASM) vendors build products around this exact capability.

Mjete:

• crt.sh — motor SQL publik për CT logs.
• Censys, Cert Spotter.
• subfinder, amass, assetfinder.

Gjetje nën-domenesh:

curl -s 'https://crt.sh/?q=%25.example.com&output=json' | jq -r '.[].name_value' | sort -u
subfinder -d example.com -all
amass enum -d example.com

1. Përdor crt.sh për tre kompani publike. Krahaso numrin e nën-domenëve të gjetur.
2. Identifiko një 'staging.' subdomain dhe diskuto rrezikun.

• RFC 6962 — Certificate Transparency.
• Google Transparency Report.