What it means
Certificate transparency analysis examines publicly logged certificate issuance to discover domains, subdomains, infrastructure relationships, and changes over time.
Why it matters
Certificates can reveal assets and naming patterns before they appear in other telemetry, but the evidence must be interpreted carefully.
Practical focus
- Search validated names and certificate attributes
- Compare issuance timing and subject alternative names
- Correlate with DNS and hosting history
- Treat discovered names as leads rather than proof of malicious use
Common mistakes
- Assuming certificate issuance means a service is active
- Attributing shared certificate infrastructure to one actor
- Ignoring wildcard and automated certificate behavior
- Scanning discovered systems without authorization
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: