3 ms·

I know about things like https://crt.sh https://crt.sh but how could you be notified about something like this? Is there some service that allows you to be aler

by rany_ 2y ago

I know about things like https://crt.sh https://crt.sh but how could you be notified about something like this? Is there some service that allows you to be alerted whenever a new certificate is generated for a domain?

jacekm 2y ago
There is free service called Certstream [0]. It does not provide notifications, you need to ingest the stream, look for the patterns of interest to you and handle notifications by yourself. But it's fairly easy and the service is commonly used by security teams. [0] https://certstream.calidog.io/ https://certstream.calidog.io/
w3ll_w3ll_w3ll 2y ago
There is this tool from Facebook. "Certificate Transparencyis an open framework which helps log, audit and monitor publicly-trusted TLS certificates on the Internet. This tool lets you search for certificates issued for a given domain and subscribe to notifications from Facebook regarding new certificates and potential phishing attacks." https://developers.facebook.com/tools/ct/search/ https://developers.facebook.com/tools/ct/search/
arccy 2y ago
crt.sh has rss feeds for any search result you throw at it, e.g.: https://crt.sh/atom?identity=chatgpt.com https://crt.sh/atom?identity=chatgpt.com most commercial offerings are about monitoring your own domain, e.g. from cloudflare, sslmate, etc.
lambdaxyzw 2y ago
You can set up your own certificate transparency listener, and get notified of every certificate created, in realtime, assuming you can handle the load. In my company we do this to scan new domains for potential phishing domains, to take them down before they become active.
- lifthrasiir 2y ago
  And if you need a concrete tool, use something like Certstream [1]. [1] https://certstream.calidog.io/ https://certstream.calidog.io/
  - ollybee 2y ago
    The amount of json you get from it it terrifying. If you do play, I found when piping though jq it could not keep on on my machine, but a jq clone called jaq handled it with no problem.
- bongodongobob 2y ago
  Interesting. What exactly are you looking for? Domain names that are similar like Micr0sotf.com and such?
raincole 2y ago
Easy, just refresh Hackernews front page 24/7.
bakugo 2y ago
Cloudflare provides this as a feature, you can choose to get an email every time a certificate for your domain is generated.

by rany_ 2y ago

jacekm 2y ago

There is free service called Certstream [0]. It does not provide notifications, you need to ingest the stream, look for the patterns of interest to you and handle notifications by yourself. But it's fairly easy and the service is commonly used by security teams. [0] https://certstream.calidog.io/ https://certstream.calidog.io/

w3ll_w3ll_w3ll 2y ago

There is this tool from Facebook. "Certificate Transparencyis an open framework which helps log, audit and monitor publicly-trusted TLS certificates on the Internet. This tool lets you search for certificates issued for a given domain and subscribe to notifications from Facebook regarding new certificates and potential phishing attacks." https://developers.facebook.com/tools/ct/search/ https://developers.facebook.com/tools/ct/search/

arccy 2y ago

crt.sh has rss feeds for any search result you throw at it, e.g.: https://crt.sh/atom?identity=chatgpt.com https://crt.sh/atom?identity=chatgpt.com most commercial offerings are about monitoring your own domain, e.g. from cloudflare, sslmate, etc.

lambdaxyzw 2y ago

You can set up your own certificate transparency listener, and get notified of every certificate created, in realtime, assuming you can handle the load. In my company we do this to scan new domains for potential phishing domains, to take them down before they become active.

lifthrasiir 2y ago
And if you need a concrete tool, use something like Certstream [1]. [1] https://certstream.calidog.io/ https://certstream.calidog.io/
- ollybee 2y ago
  The amount of json you get from it it terrifying. If you do play, I found when piping though jq it could not keep on on my machine, but a jq clone called jaq handled it with no problem.
bongodongobob 2y ago
Interesting. What exactly are you looking for? Domain names that are similar like Micr0sotf.com and such?

raincole 2y ago

Easy, just refresh Hackernews front page 24/7.

bakugo 2y ago

Cloudflare provides this as a feature, you can choose to get an email every time a certificate for your domain is generated.