certificate-transparency

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Certificate Transparency

证书透明度（Certificate Transparency）

Every publicly-trusted TLS certificate is logged to public CT logs. Those logs are a goldmine for subdomains that never appear in DNS brute-forcing — passive and complete.

每一张公开受信任的TLS证书都会被记录到公开的CT日志中。这些日志是获取子域名的宝库——无需主动探测，且覆盖全面，能找到DNS暴力破解无法发现的子域名。

Query

查询方法

bash

undefined

bash

undefined

crt.sh JSON — all certs (and subdomains) for a domain

crt.sh JSON格式 —— 某一域名的所有证书（及子域名）

curl -s 'https://crt.sh/?q=%25.example.com&output=json'
| jq -r '.[].name_value' | sed 's/*.//' | sort -u


Web UI: `https://crt.sh/?q=example.com`. Alternatives: Censys certificates
search, and `subfinder`/`amass` which query CT among other sources.

curl -s 'https://crt.sh/?q=%25.example.com&output=json'
| jq -r '.[].name_value' | sed 's/*.//' | sort -u


Web界面：`https://crt.sh/?q=example.com`。替代方案：Censys证书搜索，以及`subfinder`/`amass`这类工具（它们会查询CT日志及其他数据源）。

What it reveals

可获取的信息

Subdomains — including
```
dev
```
,
```
staging
```
,
```
vpn
```
,
```
internal-*
```
hosts an org never meant to publicize.
Sibling / acquired domains — SANs on one cert list other domains the same entity controls.
Timeline — issuance dates show when infrastructure went live; a burst of new certs can signal a launch or migration.
Internal naming — hostnames leak conventions and product codenames.

子域名 —— 包括企业无意公开的
```
dev
```
、
```
staging
```
、
```
vpn
```
、
```
internal-*
```
等主机。
关联/收购域名 —— 同一张证书的SAN（主题备用名称）会列出同一实体控制的其他域名。
时间线 —— 证书签发日期可显示基础设施上线时间；大量新证书的出现可能标志着产品发布或迁移。
内部命名规则 —— 主机名会泄露命名规范和产品代号。

Method

操作步骤

Pull all
```
name_value
```
entries for the apex domain.
Dedupe and strip wildcards.
Resolve each with
```
whois-dns-recon
```
to find which are live and their IPs.
Feed live hosts to
```
shodan-censys-recon
```
.

Certs for a wildcard (

*.example.com

) hide specific subdomains — combine CT with passive DNS to fill gaps.

获取 apex 域名的所有
```
name_value
```
条目。
去重并去除通配符。
使用
```
whois-dns-recon
```
解析每个域名，判断其是否存活及对应的IP地址。
将存活主机导入
```
shodan-censys-recon
```
进行进一步探测。

通配符证书（如

*.example.com

）不会显示具体子域名——需结合CT日志与被动DNS来填补信息空白。