SSL Certificate Enumeration

Reading SSL/TLS certificate metadata.

SSL Certificate Enumeration

Reading SSL/TLS certificate metadata.

Category: Reconnaissance

🎯 Trench — Reading SSL/TLS certificate metadata. Admins often embed in Subject Alternative Names internal domains, backend server IPs or machine names that aren’t in public DNS.

🔗 Kill chain — Absolute passive recon. You don’t touch the client’s server; you query public Certificate Transparency logs.

📡 Defensive footprint — Zero. All info is on crt.sh, publicly accessible without auth.

⚠️ False friend — Only checking the CN. The SANs are where the gems live.

🛡️ Remediation — Don’t issue certificates with internal SANs. Use private PKI for internal services.

curl -s "https://crt.sh/?q=%25.empresa.com&output=json" | jq -r '.[].name_value' | sort -u

---

← Back to the full glossary

Last updated: 2026-06-11