SSL/TLS certificates provide two broad functions:

  1. They provide a way that the ownership of a website can be validated by people who are accessing it.
  2. They provide a means by which communication between a client and server is encrypted so that it cannot be read or altered by unauthorized parties.

They also provide the information required for a browser to create a secure, encrypted connection to a web site over the HTTPS protocol. Certificates are used behind the scenes as users browse the internet. In most cases, users are not aware that they are in use. The users become aware of them if a certificate is missing, out of date, or misconfigured.

Certificate information can be viewed locally for a website that is currently displayed in a browser by clicking the padlock icon next to the URL in the browser. Certificates are also stored locally for the certificate authorities themselves. There are various ways to view them. The format of public key certificate information is specified by the X.509 standard.

Ethical hackers can use public certificate information in the reconnaissance phase of penetration tests. Certificate information can reveal details about an organization including domain and subdomain names, issuance and expiration dates, and certificate public keys. In addition, certain versions of software, such as OpenSSL, have widely known vulnerabilities that can be exploited, including vulnerability to the heartbleed bug. In addition, it is possible that some certificates could use weak encryption algorithms.

Certificate Transparency (CT)

Certificate Transparency (CT) is an open framework for monitoring and auditing the issuance of SSL/TLS certificates. CT requires that all publicly trusted certificate authorities (CAs) log all issued certificates in publicly available, tamper-evident, and auditable logs. These logs can be monitored to detect any fraudulent or malicious issuance of SSL/TLS certificates, including certificates issued for domains that the attacker does not control.

In OSINT, CT logs can be used to gather information about SSL/TLS certificates used by an organization or a specific domain. By analyzing CT logs, analysts can identify certificate issuances and their associated domains, as well as any anomalies or irregularities in certificate issuance. CT logs can also be used to monitor for any unauthorized SSL/TLS certificate issuance, which could indicate a potential security breach.

CT logs can be accessed through various CT log servers and APIs. There are also several CT monitoring tools available, such as CertSpotter and Censys, which can help automate the process of monitoring CT logs for specific domains or SSL/TLS certificates.

Kali Tools

aha

The application aha creates a standard HTML file that captures the output of terminal commands to standard HTML files. Aha captures any color coding and basic formatting of the command output. It also has command line options that allow you to specify your own formatting, such as background color, stylesheets to apply, and word wrap, among other settings.

Install aha with the sudo apt install -y aha command. The option -y assumes yes is the answers to all prompts and can run non-interactively. In this case, you are giving permission to install aha.

sslscan

Run sslscan and save the output to an HTML file

From a terminal command line, execute the command to run sslscan with the skillsforall.com target.

$sslscan skillsforall.com

After a brief delay you should see the results of scan begin to appear in the terminal window. The output is color coded to make it easier to interpret the severity of any issues detected. The meaning of the color coding is as follows: