In March 2019, an expired authentication certificate took tens of thousands of Cisco network devices offline — not because an attacker interfered, but because nobody was monitoring the expiration field.
TLS certificates are public surveillance records. The CA publishes them in append-only logs before the service goes live, with the operator having no control over the timing or destination of the publication. An attacker querying crt.sh against your infrastructure finds your new subdomains before DNS propagates, your staging environments before any legitimate user accesses them, and your infrastructure's expiration dates before your team is alerted. These logs are not an optional security feature. They are a condition of existence for any certificate from a public CA.
Your CA Published This. You Did Not Authorize It
CT log submission happens within milliseconds of issuance. The operator is still configuring the server when the certificate is already indexed and searchable by anyone with access to crt.sh. RFC 9162 (2021) defines the technical mechanism, and Google Chrome has enforced it since May 2018: a certificate without a log entry is rejected by the browser with no warning to the user. More than 10 billion certificates have been recorded in the logs since 2013, all accessible via JSON API without authentication and without any record of who queried them.
0ktapus demonstrated the practical effect of this during the 2022 campaign. Group-IB identified 169 phishing domains before most were active, pivoting on certificate issuance patterns. The certificates appeared in CT logs before the phishing sites became accessible, exposing targets including Twilio, Cloudflare, LastPass, and 130 other organizations. The certificate is not an artifact of a deployed service; it is the deployment announcement, published by the CA as a mandatory step before any request is served.
SAN Fields Are Org Charts for Attackers
The Subject Alternative Name field lists every hostname covered by the certificate. A single certificate for api-staging.empresa.com, internal-proxy.empresa.com, mailrelay.empresa.com, and dev.empresa.com reveals in one query: the scope of the development environment, the existence of an internal proxy, the email relay configuration, and the staging-to-production separation. This happens before any HTTP request reaches the server, and regardless of whether those hosts have public DNS records.
Organizations operating multiple domains through a holding company expose acquisition structure in the SANs of multi-domain certificates. A corporate certificate with *.empresa-adquirida.com in the SAN field appears in the CT log before the acquisition press release. The X.509 certificate OSINT analysis published by Gigamon found that large corporations expose organizational boundaries in multi-SAN certificates, including hosting platform fingerprints that identify the provider without interacting with the server.
The UCSB research published at EuroS&P 2023 showed that systematic CT log analysis allows discovering hostnames that never appear in public DNS, and correlating software versions exposed on those hostnames with known vulnerabilities at scale without sending a single active packet against the target. Domains hosted on cPanel include cpanel. subdomains in the SANs as default platform behavior. This is not a misconfiguration. It is the expected behavior of those platforms, recorded by mandate in a global log accessible without authentication.
Issuance Timestamps Are a Deployment Intelligence Feed
A new certificate in the CT logs means a new service is arriving. The window between issuance and the service becoming accessible is typically 1 to 48 hours. Attackers monitoring CT logs reach the target before the WAF has rules written for the new endpoint, before the security team knows the service exists, and before the first legitimate user makes a request.
Group-IB used precisely this timing in the 0ktapus investigation (2022). Phishing infrastructure certificates appeared in CT logs 2 to 8 hours before the sites went live. By tracking the issuance pattern, investigators mapped 169 domains attacking Twilio, Cloudflare, LastPass, DoorDash, Signal, and over 130 organizations. The investigation led to the arrest of leader Tyler Buchanan at Palma de Mallorca airport in June 2024. The same feed that coordinated the attack served as the forensic evidence chain to reconstruct it.
River Security pentesters documented the operational pattern that follows from this: they monitor CT logs for mentions of the target brand, run a DNS delta against newly discovered hosts, and reach new endpoints proactively before any internal alert fires. Renewal timing also carries operational intelligence. Let's Encrypt uses 90-day cycles; a domain that stopped renewing for more than 6 months but still resolves in DNS is a subdomain takeover candidate. The expired certificate in the CT log is the signal. The DNS record still pointing to the host is the attack surface.
Wildcard Certificates Trade Operational Convenience for Permanent CT Log Scope Disclosure
A wildcard *.empresa.com simplifies management: a single private key covers all subdomains. The cost visible in the CT log is immediate. Anyone querying the log knows that the company's subdomain namespace is unbounded, that any subdomain discovered through brute-force potentially exists in production, and that a private key compromise affects all covered services simultaneously.
CA/Browser Forum Ballot SC-63 (2024) restricts wildcard scope to a single subdomain level — *.example.com cannot cover api.dev.example.com. Revocation is the underlying structural problem. OCSP servers are frequently unavailable at the moment a compromised certificate is being used, and Keyfactor documented that rotating a compromised wildcard across multiple servers amplifies downtime risk and extends the exposure window. A revoked wildcard in theory remains valid in practice for hours while clients do not receive the status update.
The decisive metric is blast radius per compromise. A certificate with explicit SANs for api.empresa.com and app.empresa.com limits exposure to two services in the worst case. A wildcard *.empresa.com has no such limit. The convenience of managing fewer certificates comes at the cost of turning any key compromise into a full-scope incident, and that scope has been published since day one in the CT log.
An Expired Certificate Is a Marker of an Abandoned Asset
In May 2023, Cisco SD-WAN disrupted service for more than 20,000 customers. The root cause was certificates from the 2017 Viptela acquisition, not renewed four years later, mid-way through a 10-year validity cycle (device authentication certificates issued by Cisco's private CA, not subject to the 397-day maximum that the CA/Browser Forum applies to publicly trusted certificates). The expiration date was in the CT logs since original issuance. No team monitored the logs for acquired infrastructure in the intervening four years.
The pattern repeats across sectors: long-lived authentication certificates in telecommunications, energy, and critical infrastructure have renewal cycles measured in years, not weeks.
From an attacker's perspective, an expired certificate on an active domain with DNS still resolving signals insufficient operational attention. CVE-2023-40104 (Android ca-certificates, CWE-295, published November 2023) allowed TLS data disclosure without user interaction on Android 12 through 14, a reminder that certificate lifecycle failures create a direct attack surface without requiring the attacker to find a new bug. A domain with an expired certificate, active DNS, and no redirect is a top candidate for CNAME takeover verification.
CT Logs as an Early Warning System for Defenders
The same public feed that attackers query is available to defenders at no cost and without authentication. crt.sh offers manual querying through a web interface and a JSON API with wildcard query support. CertSpotter (SSLMate) delivers real-time alerts for new certificates issued against monitored domains, regardless of which CA issued them, covering the scenario of a compromised CA issuing unauthorized certificates.
The highest-signal alert triggers are specific: a new certificate for *.yourdomain.com issued by an unexpected CA can indicate phishing or CA compromise. A new subdomain not yet deployed signals untracked surface expansion. A certificate for paypal-yourdomain.com indicates phishing using your brand as a prefix or suffix. The UK CHAPS/RTGS incident (July 2024) illustrated the failure mode from the defender side: the certificate expired without internal alert — any external CT log monitor would have flagged the expiry date months in advance.
intel.mago.team (MAGO team tool) automates CT log monitoring, correlating new certificate issuance with DNS resolution for continuous attack surface tracking of monitored targets without firing active scans. Receiving the alert before the certificate is in production puts you at the same vantage point the attacker would use to plan access.
CT logs are not going away. Browser security depends on them as the mandatory audit mechanism for the CA ecosystem. The question is not whether your certificates are public: they are, from the millisecond of issuance, with no exceptions for any publicly trusted CA. The question is who queries crt.sh for your domain first. Every SAN in the results is a surface you are responsible for, regardless of whether you remember issuing that certificate.
Top comments (0)