cert-intel

    ██████╗███████╗██████╗ ████████╗    ██╗███╗   ██╗████████╗███████╗██╗
   ██╔════╝██╔════╝██╔══██╗╚══██╔══╝    ██║████╗  ██║╚══██╔══╝██╔════╝██║
   ██║     █████╗  ██████╔╝   ██║       ██║██╔██╗ ██║   ██║   █████╗  ██║
   ██║     ██╔══╝  ██╔══██╗   ██║       ██║██║╚██╗██║   ██║   ██╔══╝  ██║
   ╚██████╗███████╗██║  ██║   ██║       ██║██║ ╚████║   ██║   ███████╗███████╗
    ╚═════╝╚══════╝╚═╝  ╚═╝   ╚═╝       ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚══════╝╚══════╝

Certificate Intelligence & CT Log Mining — production-grade TLS/SSL analysis, Certificate Transparency log reconnaissance, and passive subdomain discovery. Built for security researchers, red teamers, and infrastructure engineers.

---

Overview

cert-intel is a zero-noise, high-signal CLI tool that performs deep TLS certificate analysis against any domain. It concurrently retrieves the live certificate directly over a raw TLS handshake and mines the public Certificate Transparency ecosystem via crt.sh — surfacing issued certificates, expiry timelines, security misconfigurations, and passive subdomain intelligence, all in a clean terminal interface.

---

Features

Capability	Detail
Live TLS Handshake	Connects directly, extracts full cert chain — subject, issuer, SANs, serial, version, SHA-1/SHA-256 fingerprints
CT Log Mining	Queries crt.sh for up to N historical entries — issuer names, validity windows, raw name values
Passive Subdomain Discovery	Extracts every unique DNS name from CT log name_value fields — no active probing required
Security Analysis	Detects expiry, imminent expiry (7/30/90-day thresholds), and self-signed certificates with severity grading
Certificate Timeline	First/latest issuance dates, total cert count, average issuance rate over the observation window
Async Concurrent Execution	Live cert fetch and CT log query fire simultaneously via asyncio.gather + thread executor
JSON Export	Full machine-readable report: cert data, CT entries (up to 500), subdomains, security issues, scan metadata
Quiet/Pipe Mode	--quiet suppresses all UI and writes a compact JSON payload to stdout — pipe directly into jq or other tools
Strict Input Validation	Domain regex, port range, limit bounds — all validated at parse time before any I/O
POSIX Exit Codes	0 success · 1 runtime error · 2 argument error · 130 keyboard interrupt

---

Installation

Requirements: Python 3.10 or higher.

git clone https://github.com/linxploit/cert-intel.git
cd cert-intel
pip install -r requirements.txt

---

Usage

usage: cert_intel [-h] [--port PORT] [--limit N] [--export FILE]
                  [--no-live] [--no-ct] [--timeout SECONDS]
                  [--verbose | --quiet]
                  domain

Arguments

Argument	Short	Default	Description
domain	—	—	Target domain (e.g. example.com, https://sub.example.com/path)
--port	-p	443	TLS port to connect to
--limit	-l	100	Maximum CT log entries to retrieve
--export	-e	—	Write full JSON report to file
--no-live	—	—	Skip live TLS certificate retrieval
--no-ct	—	—	Skip Certificate Transparency log query
--timeout	-t	10.0	Network timeout in seconds
--verbose	-v	—	Debug-level logging
--quiet	-q	—	Suppress all output; write JSON to stdout

Examples

# Standard scan
python main.py example.com

# Non-standard TLS port, retrieve up to 200 CT entries
python main.py example.com --port 8443 --limit 200

# Export full report to JSON
python main.py example.com --export report.json

# CT logs only (skip live handshake)
python main.py example.com --no-live

# Pipe quiet JSON output into jq
python main.py example.com --quiet | jq '.subdomains'

# Debug mode with extended timeout
python main.py example.com --verbose --timeout 20

---

Output Sections

┌─────────────────────────────────────┐
│  Scan Parameters                    │  Target, port, scan ID, timestamp
├─────────────────────────────────────┤
│  Live TLS Certificate               │  Subject, issuer, SANs, fingerprints,
│                                     │  validity window, status, security issues
├─────────────────────────────────────┤
│  CT Logs  (N entries retrieved)     │  Table: ID · issuer · not_before · not_after
├─────────────────────────────────────┤
│  Discovered Subdomains              │  Passively extracted from CT name_value fields
├─────────────────────────────────────┤
│  Certificate Timeline               │  First/latest issuance, rate, observation window
├─────────────────────────────────────┤
│  Recommendations                    │  Severity-graded findings + action items
├─────────────────────────────────────┤
│  Summary                            │  Duration, CT count, subdomain count
└─────────────────────────────────────┘

---

JSON Export Schema

{
  "scan_id": "20250523_142301",
  "domain": "example.com",
  "timestamp": "2025-05-23T14:23:01.482910",
  "duration_seconds": 3.84,
  "live_certificate": {
    "subject": { "commonName": "example.com", "organizationName": "..." },
    "issuer":  { "commonName": "R11", "organizationName": "Let's Encrypt" },
    "not_before": "Apr  1 00:00:00 2025 GMT",
    "not_after":  "Jun 30 23:59:59 2025 GMT",
    "serial_number": "0A1B2C...",
    "version": 3,
    "fingerprint_sha1":   "a1b2c3...",
    "fingerprint_sha256": "d4e5f6...",
    "san": ["example.com", "www.example.com"]
  },
  "ct_logs": [ { "id": 123456789, "issuer_name": "...", "name_value": "...", "not_before": "...", "not_after": "..." } ],
  "discovered_subdomains": ["api.example.com", "mail.example.com"],
  "security_issues": []
}

---

Security Severity Reference

Severity	Trigger Condition
CRITICAL	Certificate expired or expires within 7 days
HIGH	Expires within 30 days · Self-signed certificate detected
MEDIUM	Expires within 90 days

---

Project Structure

cert-intel/
├── main.py            # Entry point
├── cert_intel.py      # Full tool — async engine, rendering, argparse, export
├── requirements.txt   # Runtime dependencies
├── README.md
├── .gitignore
└── LICENSE

---

Dependencies

Package	Purpose
rich	Terminal UI — panels, tables, progress, themes
requests	HTTP client for crt.sh CT log queries
certifi	Mozilla CA bundle for TLS context

All standard library — asyncio, ssl, socket, hashlib, argparse, json, re, logging — no additional installs required.

---

Legal & Ethics

This tool queries only public Certificate Transparency logs and performs a standard TLS handshake — the same operation any browser performs when connecting to a site. No vulnerability exploitation, no active probing beyond port connection, no data exfiltration. Use responsibly and only against domains you own or have explicit authorization to test.

---

License

MIT — see LICENSE.

---

Author

Built with precision by Hamid | Mindless · Linxploit
For authorized security research only.