Lion Cipher Lab
Monitor Certificate Transparency for certificates mis-issued for your own domain
- Threat Intel Analyst
- Intermediate
- ~75 min
- Free · no account required
Why it matters
The same Certificate Transparency logs that let you hunt an attacker's lookalike domains are watching your OWN domain too, and that second use is the one almost nobody switches on. Every publicly trusted certificate issued anywhere in the world is published to public append-only logs within seconds — including every certificate issued in YOUR name, whether or not you asked for it. That matters because the whole certificate system rested on every CA behaving, there are hundreds of them, and any one of them can technically issue a certificate for any domain. When that goes wrong — a rogue or…
What you'll learn
- the defensive use of Certificate Transparency: watching for certificates issued for YOUR domain that you never asked for, as opposed to hunting attacker lookalikes
- reading a crt.sh-style CT log entry and parsing the issuer organization out of an RFC 4514 distinguished name
- collapsing the precertificate/leaf pair into one logical certificate by de-duplicating on the serial number, so you never double-count
- building an approved-CA allowlist and flagging any issuance from a CA that is not on it (the rogue / unexpected CA case)
- comparing an issuance against a domain's published CAA policy, and understanding why the allowlist and the CAA record are two different checks that disagree on purpose
- catching unauthorized hostnames and unexpected wildcards (shadow IT) by diffing the certificate's SAN list against a known-asset inventory
- measuring a detection honestly: computing precision before and after, and showing a naive 'alert on every cert' monitor collapse from 0.38 to 1.00
- knowing the blind spots: CT shows issuance not abuse, a monitor is detective while CAA is preventive, and a trusted-CA mis-issuance is rare but real
Steps in this lab
- The opposite job: watching your OWN domain, not the attacker's
- The five words you need: CAA, allowlist, SAN, precert/leaf, mis-issuance
- Set up: Python 3 and the inline CT fixture (fully offline)
- Dedup first: collapse the precertificate/leaf pair by serial number
- Check 1: the approved-CA allowlist (and parsing the issuer)
- Check 2: the CAA-policy comparison — and why it is NOT the allowlist
- Check 3: unexpected hostnames and wildcards (the shadow-IT net)
- Run it: the before/after precision you came for
- The honest limits: issuance is not abuse, and this is detective not preventive
- When, why and better: crt.sh, certstream, managed services — and the skill that lasts