PKI

Use Certificate Transparency as a Detection Signal

A TLS certificate can be valid in every cryptographic sense and still be operationally unexpected. A forgotten staging host may receive a certificate through an automated pipeline. A vendor may issue for a delegated subdomain that the central security team did not know existed. More seriously, an attacker who gains control of a DNS validation path or a certificate-authority account may obtain a certificate for a name they should not control.