Skip to content

theswerd/certtrack

Repository files navigation

CertTrack

Real-time Certificate Transparency log explorer. Watch newly issued TLS certificates appear as they're published to public CT logs.

View Live Demo

What is this?

CertTrack monitors Certificate Transparency logs in real-time, showing you newly issued TLS certificates as they appear. You can watch the stream of certificates, filter by domain, and explore the details of each certificate.

Background

My company Freestyle (YC S24) provisions a lot of certificates for our customers. We noticed a shocking amount of malicious traffic going to our customers' preview domains—hundreds of malicious requests per second—which was confusing because these domains aren't routed via DNS.

After investigation, we discovered that attackers were using CT logs to discover domains, then sending traffic directly to our IPs with the Host header set to those domains. This project is my exploration into how CT logs work, why they exist, and how to understand them to protect customers.

What is Certificate Transparency?

Certificate Transparency (CT) is a standard which requires certificate authorities to publish all TLS certificates they issue to publicly auditable, append-only logs. This serves as an audit log for security researchers and as a verification step for browsers to ensure certificates are believed to be valid by their issuer.

How bad actors abuse CT logs

Based on our analytics, the vast majority of malicious requests are:

  • Scanning for uninitialized sites: Looking for PHP and WordPress websites with admin paths, unauthenticated setup routes, and other tells of uninitialized websites. Attackers aim to sign into the admin before the legitimate user can.
  • Hunting for sensitive files: Requesting /.env, /api/config.json, /.git/config, and other configuration files that could leak credentials or sensitive information.

Mitigation tips

There's no perfect way to prevent this, but acting with awareness helps:

  1. Use wildcard certificates whenever possible—individual subdomains won't be exposed
  2. Don't launch with detectable uninitialized states—avoid default install pages, exposed setup routes, etc.
  3. Be aware that once a certificate is issued, the domain is public—even before it has any traffic

Technical details

Tech stack

  • Next.js 16
  • React 19
  • TypeScript
  • Tailwind CSS 4
  • Radix UI
  • @peculiar/x509 for certificate parsing

Running locally

# Clone the repository
git clone https://github.com/theswerd/certtrack.git
cd certtrack

# Install dependencies
bun install

# Start the development server
bun dev

Open http://localhost:3000 to view it in your browser.

Links

Author

Built by Ben Swerdlow

About

Exploration into public Certificate Transparency Logs

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages