auditing-tls-certificate-transparency-logs

Query the crt.sh JSON API with a wildcard pattern like %.example.com, store results in a baseline SQLite database, and compare new entries against an authorized CA list. The agent automates this with polling intervals, retry backoff on HTTP 429, and email or webhook alerts.

Extract the name_value field from crt.sh certificate records, which contains all SANs including subdomains not in DNS zone files. Validate each discovered subdomain with DNS A/AAAA and CNAME resolution to identify active services and takeover candidates.

Core monitoring requires only the requests library for crt.sh API access. The cryptography and pyOpenSSL packages are optional, needed only for direct X.509 certificate parsing beyond what the crt.sh JSON API provides.

crt.sh enforces rate limits returning HTTP 429 when queried too frequently. Implement exponential backoff between retries, cache responses, space typosquat scans with delays, or use the crt.sh PostgreSQL interface directly for high-volume monitoring.

CT data only shows subdomains that received certificates, missing non-HTTPS services, and wildcard DNS can make non-existent subdomains appear active. Cross-reference results with passive DNS databases and confirm scope with asset owners before testing.