| name | certificate-transparency-basics |
| description | Certificate Transparency (CT) logs and Signed Certificate Timestamps (SCTs) for authorized recon, mis-issuance detection, and TLS evidence. Use when querying CT logs for hostnames, verifying SCTs in certificates or TLS handshakes, monitoring org domains for unexpected issuance, or documenting CT inclusion for compliance and incident response — not for abusing third-party log infrastructure or mass-harvesting unrelated Internet assets.
|
Certificate Transparency Basics (Logs And SCT)
Work with public CT logs and SCTs so issuance is discoverable and
auditable. Owned/authorized domains, in-scope bounty assets, labs, and defensive
monitoring only — not unscoped bulk collection.
When To Use
| Situation | Direction |
|---|
| Discover certs/SANs for in-scope domains via CT | This skill |
| Verify SCTs (X.509 extension, TLS handshake, or OCSP) | This skill |
| Alert on unexpected CA or subdomain issuance | This skill |
| Incident: who issued this cert / when was it logged? | This skill |
| Client CT policy / qualified log list awareness | This skill |
| ACME issuance automation in Kubernetes | cert-manager-basics |
| Edge TLS headers/ciphers only | nginx-security-headers |
| TLS plaintext capture / pin bypass RE | tls-plaintext-acquisition |
| Secret/key material in repos or stores | secrets-management-hygiene |
Do not use as primary for pure ACME solver debugging, cipher audits, or
general web recon without a CT angle.
Workflow
1. Define scope and questions
- List apex domains, known wildcards, and brands in scope.
- State the goal: asset inventory, mis-issuance hunt, SCT compliance, or IR.
- Prefer read-only public log queries and local cert inspection first.
2. Query CT for issuance evidence
Public indexes (e.g. crt.sh, Censys, org SIEM CT feeds) aggregate many logs.
For each in-scope name:
- Collect leaf certs and precertificates: subject, SANs, issuer, notBefore/After,
serial, fingerprint.
- Note wildcards (
*.example.com) and surprising subdomains or sister brands.
- Deduplicate by fingerprint; keep first-seen log time vs cert
notBefore.
- Flag issuers outside the org allowlist or unexpected validation methods.
Treat CT hits as hints: DNS may no longer serve those hosts; confirm
ownership and live exposure under engagement rules before high-severity claims.
3. Understand SCTs and delivery
An SCT is a log’s promise that a (pre)certificate was or will be included.
Browsers may require SCTs from qualified logs.
| Delivery | Where you see it |
|---|
| X.509 extension | signedCertificateTimestampList in leaf/precert |
| TLS extension | signed_certificate_timestamp during handshake |
| OCSP stapling | SCT list in OCSP response |
- On owned endpoints, capture the chain (browser,
openssl s_client, approved scanners).
- Record how many SCTs, which logs, and timestamp alignment with issuance.
- Missing or insufficient SCTs may violate current client CT policy — cite the
policy version you claim, not folklore.
4. Logs, Merkle trees, and inclusion (essentials)
- Logs are append-only; entries are Merkle-tree leaves (cert or precert).
- Precertificates (poison extension) let CAs obtain SCTs before final issue
without the precert being a usable server cert.
- Inclusion/consistency proofs audit log honesty; day-to-day recon usually stops
at “observed in log X at time T.”
- Prefer qualified public logs for client-acceptance checks; retired or
untrusted logs do not satisfy modern CT policy.
5. Mis-issuance monitoring and CAA
- Baseline known CAs, name patterns, and staging vs prod issuers.
- Alert on: new CA, unexpected wildcard, private/internal names in public CT,
mass reissue spikes, or lookalikes if brand scope includes them.
- Respond: CA contact / lifecycle, revoke when required, close inventory gaps.
- After findings, verify CAA DNS matches the intended CA set (CT shows what
was issued; CAA constrains who may issue).
- Filter noise: known ACME renewals and CDN-managed certs after allowlisting.
6. Evidence pack
Store query terms, raw export (redact if needed), cert PEMs or fingerprints,
SCT summary, timestamps, and live host confirmation. Keep originals immutable;
work from copies.
Routing
| Need | Skill |
|---|
| CT log search, SCT verification, mis-issuance monitoring | This skill |
| cert-manager / ACME issuance in cluster | cert-manager-basics |
| nginx/edge TLS and security headers | nginx-security-headers |
| TLS capture, MITM lab, pin bypass (owned) | tls-plaintext-acquisition |
| Private keys, ACME account keys, CA material | secrets-management-hygiene |
| Broad estate recon plan | recon-and-methodology |
| Safe code/config for monitors or parsers | code-quality-standards |
Keep this skill primary for log/SCT work; hand off issuance automation,
edge hardening, secrets, or capture RE when those dominate.
Output Checklist
Scope And Authorization
- In scope: domains/certs you own; SOW/bug-bounty assets; public CT data for
those names; lab monitoring pipelines you operate.
- Out of scope: mapping/attacking third parties without permission via CT;
DoS or abuse of log/index APIs; forging SCTs or log responses; mass scraping
beyond engagement needs.
- Prefer rate-limited, cache-friendly queries; respect index ToS.
- CT is public history — still minimize publishing full SAN dumps of unreleased
hostnames when policy requires discretion.
- CT presence is not proof of live compromise; pair with DNS/HTTP/ownership checks.
