The Facebook tool detects certificates issued for specified domains.
Facebook has released a free tool for Certificate Transparency monitoring to aide website owners and domain administrators. The tool enables users to easily search Certificate Transparency logs and set up automatic monitoring that alerts you when any new certificates are issued for your domains.
Certificate Transparency (CT) is one of the most significant improvements to the Web PKI infrastructure, which SSL and Certificate Authorities are part of. CT allows Certificate Authorities, who issue certificates, to publicly log them for everyone to see. By providing transparency into what certificates are being issued, the community can quickly detect when a certificate has been mis-issued, which is one of the most critical security threats to SSL/TLS.
Before CT existed, there was no effective way of doing this. Large internet companies and researchers could scan and monitor what certificates they see out there, but that gave an incomplete picture at best, and gave smaller organizations no chance of knowing if certificate’s were being improperly issued for their domains.
Next year, Chrome will require Certificate Transparency for all SSL certificates, which will make monitoring significantly more effective. Mozilla has also pledged to support Certificate Transparency in their browser.
Facebook’s monitoring tool searches through CT logs and stores the data, updating on an hourly basis so that data is always fresh and any problems can be detected quickly.
It’s a simple tool, but has all the essential features you need. You can search by domain name, and subscribe to receive email alerts whenever an SSL certificate is issued for that domain. For each certificate you can easily see the domains it is issued for, subject information, issuer, validity period, and the PEM formatted certificate.
Monitoring Certificate Transparency logs can be useful in a number of scenarios. The most important function is detecting malicious certificate issuance – where an attacker has been able to defeat or compromise a CA and issue a certificate for your domain.
Monitoring can also help with everyday administrative tasks.
Larger organizations often struggle with keeping track of where and when certificates are being deployed across their network. We have seen different departments within an org buying certificate from multiple providers, or even setting up multiple accounts with the same provider. This can cause a bit of a headache when it comes to billing and efficient management. If you set up CT monitoring, you can quickly catch this and consolidate your certificate issuance.
You can start using Facebook’s tool today, and sign up for emails alerts for all your domains. The only downside to Facebook’s tool is that you need a Facebook account to use it.