Lesson 2.26: Watching Certificate Transparency logs
Every publicly trusted TLS certificate is written to public, append-only Certificate Transparency (CT) logs; browsers reject certificates that aren't. That means you can see every certificate any CA has issued for your domains, including ones you didn't ask for. In the lab you read a crt.sh export for northwind.example: which CAs issue for you, what your CAA record allows, a wildcard certificate from a CA you never use, and hostnames nobody has in the asset inventory.
15 min
You will learn to
- Explain Certificate Transparency
- Read crt.sh JSON with jq
- Check a domain's CAA record
- Spot unexpected issuers and wildcards
- Find shadow IT through CT
Key terms
- Certificate Transparency (CT)
- Public, append-only logs of issued certificates; browsers require public certificates to appear in them.
- crt.sh
- A free search service over CT logs, with a JSON output.
- CAA record
- A DNS record naming the CAs allowed to issue for a domain (issue, issuewild, iodef).
- Mis-issuance
- A certificate a CA should not have issued; reported to the CA and browsers.
- Shadow IT
- Systems run without the IT or security team knowing.
← Verifying downloads · All lessons · The xz-utils backdoor: a compromised maintainer →