Skip to main content

Reading SSL/TLS certificate metadata.

Category: Reconnaissance 🎯 Trench — Reading SSL/TLS certificate metadata. Admins often embed in Subject Alternative Names internal domains, backend server IPs or machine names that aren’t in public DNS. 🔗 Kill chain — Absolute passive recon. You don’t touch the client’s server; you query public Certificate Transparency logs. 📡 Defensive footprint — Zero. All info is on crt.sh, publicly accessible without auth. ⚠️ False friend — Only checking the CN. The SANs are where the gems live. 🛡️ Remediation — Don’t issue certificates with internal SANs. Use private PKI for internal services.
← Back to the full glossary Last updated: 2026-06-11