Overview
TLS certificates are public documents that reveal domain and infrastructure information — a valuable OSINT source. This lesson introduces certificates in OSINT.
Learning objectives
- Explain what TLS certificates are and reveal.
- Describe certificate information relevant to OSINT.
- Connect certificates to domain intelligence.
Core concept
A TLS certificate proves a server's identity and enables HTTPS (from the networking TLS lesson). Certificates are public (presented to any client) and contain useful information: the domain name(s) they cover (including in the SAN field — next lesson), the issuer (Certificate Authority), validity dates, and organizational details. In OSINT, certificates reveal an organization's domains/subdomains and infrastructure clues, and — via Certificate Transparency logs (covered in this module) — a searchable public record of all issued certificates. They're a valuable, largely-passive domain-intelligence source.
How it works
The practitioner examines an organization's public certificates — from live servers and, powerfully, from Certificate Transparency logs — to extract the domain names they cover, the issuing CA, validity periods, and organizational information. Because certificates list the names they secure (often multiple, via SANs), they reveal subdomains and related domains — sometimes ones not easily found otherwise. This is public data (certificates are presented openly; CT logs are public records), gathered passively. Certificate information complements DNS and WHOIS in the domain picture. As always, findings are verified and combined with other sources.
Practical example
Examining an organization's public certificate (from its server or CT logs), the practitioner extracts the domain names it covers — revealing several subdomains, including one not found via DNS guessing — plus the issuing CA and validity dates. These names expand the organization's known domain footprint. All from public certificate data, gathered passively. Combined with DNS and WHOIS data (and verified), the certificate information enriched the domain intelligence picture, especially by surfacing an otherwise-hidden subdomain.
Cybersecurity relevance
Certificates are a valuable, largely-passive OSINT source for domain/subdomain discovery and infrastructure clues — often revealing subdomains DNS enumeration misses, via the names certificates cover and the public Certificate Transparency logs (connecting to the ethical-hacking passive-recon and bug-bounty subdomain-enumeration certificate lessons). For defenders, it highlights that obtaining a certificate makes covered names publicly visible (footprint exposure). It uses public data (certificates are presented openly; CT is public), gathered ethically and verified, and complements DNS/WHOIS. This module details SANs, Certificate Transparency, asset discovery, and verification — with certificates as a powerful subdomain-discovery source.
Common mistakes
- Overlooking certificates as a subdomain/infrastructure source.
- Assuming certificate-covered names are private — they're public (and logged in CT).
- Not combining certificate data with DNS/WHOIS or verifying it.
Key takeaways
- TLS certificates are public documents revealing the domain names they cover (incl. subdomains via SANs), the issuing CA, validity, and organizational details.
- They're a valuable, largely-passive OSINT source for domain/subdomain discovery, especially via public Certificate Transparency logs — often surfacing subdomains DNS misses.
- Public data gathered ethically and verified, complementing DNS/WHOIS; it highlights footprint exposure for defenders (certificates make names public).
Check your understanding
- What information relevant to OSINT do TLS certificates contain?
- Why are certificates valuable for discovering subdomains, and why are covered names public?