cert-transparency

What this skill does

Queries TLS/SSL certificates issued for a specific domain via the crt.sh Certificate Transparency (CT) log API. Extracts subdomains from the CN (Common Name) and SAN (Subject Alternative Name) fields of certificates, deduplicates them, and expands the attack surface.

When to use

• Enumerating subdomains passively (no DNS queries)
• Discovering subdomains covered by wildcard certificates
• Auditing the list of certificates issued by a specific organization
• Supplementing subfinder/amass results with an additional source

Prerequisites

• Install curl:

  sudo apt-get install -y curl
  

• Install jq (JSON parsing):

  sudo apt-get install -y jq
  

• External internet access required (crt.sh API calls)
• Environment variable SECSKILL_TARGET_DOMAIN: domain to query

Inputs

Variable	Required	Description
SECSKILL_TARGET_DOMAIN	Required	Root domain to query (e.g. example.com)
SECSKILL_OUTPUT_DIR	Optional	Output directory for results (default: ./output)
SECSKILL_INCLUDE_EXPIRED	Optional	Set to true to include expired certificates (default: false)

Workflow

Step 1: Prepare environment

export TARGET="${SECSKILL_TARGET_DOMAIN:?Set the SECSKILL_TARGET_DOMAIN environment variable}"
export OUTDIR="${SECSKILL_OUTPUT_DIR:-./output}"
export INCLUDE_EXPIRED="${SECSKILL_INCLUDE_EXPIRED:-false}"
mkdir -p "$OUTDIR"
echo "[*] Starting Certificate Transparency lookup: $TARGET"

Step 2: Query crt.sh API

echo "[*] Querying crt.sh API..."
CRT_URL="https://crt.sh/?q=%.${TARGET}&output=json"

RAW_JSON="$OUTDIR/crt_raw_${TARGET}.json"

HTTP_CODE=$(curl -s -o "$RAW_JSON" -w "%{http_code}" \
  --max-time 30 \
  --retry 3 \
  --retry-delay 5 \
  "$CRT_URL")

if [ "$HTTP_CODE" != "200" ]; then
  echo "[-] crt.sh API error (HTTP $HTTP_CODE). Please retry after a moment."
  exit 1
fi

CERT_COUNT=$(jq 'length' "$RAW_JSON" 2>/dev/null || echo "0")
echo "[+] Certificates found: $CERT_COUNT"