Overview
Certificate data drives asset discovery — identifying an organization's domains, subdomains, and infrastructure. This lesson covers certificate-based asset discovery.
Learning objectives
- Explain asset discovery via certificate data.
- Describe building an asset picture from certificates.
- Connect certificate discovery to the broader footprint.
Core concept
Asset discovery via certificates uses certificate data (SANs, CT logs) to identify an organization's domains, subdomains, and related infrastructure — building a picture of its public footprint. Because certificates publicly disclose the names they cover, and CT logs record all issued certificates, certificate data is a rich source for enumerating an organization's assets — often surfacing subdomains and related domains that expand the known footprint beyond what DNS alone reveals. Certificate-based asset discovery complements DNS and WHOIS to build a comprehensive footprint.
How it works
The practitioner uses certificate sources — live-server certificates and CT logs — to enumerate the organization's names: extracting covered domains/subdomains from SANs and CT records, and identifying related domains (e.g. certificates covering multiple related domains suggest they're connected). This builds an asset inventory of the organization's public domains/subdomains. Certificate discovery is especially valuable for finding subdomains other methods miss. The discovered assets are verified (resolve/live? in-scope for the legitimate purpose?) and combined with DNS, WHOIS, and historical data for a complete footprint. It's a core technique for comprehensive, passive asset enumeration.
Practical example
Using certificate data (CT logs and server certificates), the practitioner enumerates an organization's assets: extracting covered names to find multiple subdomains and identifying a related domain that shares certificates — building an asset picture broader than DNS alone provided. They verify which discovered names are live and combine them with DNS/WHOIS data for a comprehensive footprint. Certificate-based asset discovery surfaced subdomains and a related domain that enriched the overall picture — its key contribution to footprint mapping.
Cybersecurity relevance
Certificate-based asset discovery is a core, passive OSINT technique for enumerating an organization's domains, subdomains, and related infrastructure — valuable for security assessment (attack-surface/footprint mapping), threat intelligence, and due diligence, and often surfacing assets DNS misses (connecting to the bug-bounty asset-discovery and subdomain-enumeration lessons). For defenders, it highlights that certificate data publicly reveals their asset footprint (and can uncover forgotten/exposed subdomains to address). It uses public certificate/CT data, gathered passively, verified, and combined with DNS/WHOIS/historical data. It's a key contributor to a comprehensive public-footprint picture.
Common mistakes
- Relying on DNS alone for asset discovery, missing certificate-revealed subdomains/related domains.
- Not verifying certificate-discovered assets (resolve/live) before treating them as active.
- Not combining certificate data with DNS/WHOIS/historical for a full footprint.
Key takeaways
- Certificate-based asset discovery uses SANs and CT logs to enumerate an organization's domains, subdomains, and related infrastructure, building its public footprint.
- It often surfaces subdomains and related domains DNS alone misses, complementing DNS/WHOIS/historical data.
- Public data gathered passively and verified; a core footprint-mapping technique (for security/threat-intel/due-diligence) that also highlights asset exposure for defenders.
Check your understanding
- How does certificate data (SANs, CT logs) drive asset discovery?
- Why does certificate-based discovery complement DNS for building a complete footprint?