Certificate streams

After this lesson you can

Run a certificate feed as a live channel rather than a periodic search.

Assumes you have read Registration feeds.

Certificate Transparency can be searched periodically or consumed as a stream. The difference matters, because the value of a certificate signal decays in hours.

Search against stream

	Periodic search	Live stream
Latency	Your polling interval — usually hours	Seconds to minutes after submission
Query shape	One brand string at a time	Every entry, filtered by you
Volume handled	Whatever the search returns	Millions a day, filtered locally
Best for	Retrospective investigation	Detection

Because certificate issuance typically precedes use by hours, a six-hour polling interval can consume most of the warning the channel provides. A stream turns it into minutes.

Filtering a stream

For each certificate observed:
  for each SAN:
    normalise (lowercase, strip trailing dot, punycode-decode)
    if SAN in watchlist                -> ALERT
    if brand-string appears as a label -> queue
    if SAN is ours                     -> drop
    else                               -> drop

Then, always:
  dedupe by certificate fingerprint
  dedupe by SAN first-seen

Punycode-decode before matching. A homograph domain arrives in the log as xn-- and will not match a brand string otherwise.
Match on labels, not substrings. northwind as a whole label is a signal; as part of a longer word it is noise.
Drop your own names first, before any other rule. Renewals are the largest single source of volume.

Keep every observation, alert on almost none

Storing every matched SAN with a first-seen timestamp costs very little and gives you the history that answers “when did this start” during an incident. The alerting rule should stay narrow; the recording rule should be generous. They are different decisions and are frequently conflated.

Knowledge check

Why does a six-hour CT polling interval waste most of the channel’s value?

Certificate issuance typically precedes use by hours, so the warning window is often gone before the poll runs.
Because the logs discard entries older than a few hours.
Because search APIs rate-limit frequent queries.
Because certificates are logged only once per day.

Correct — Certificate issuance typically precedes use by hours, so the warning window is often gone before the poll runs. It is the only channel that reliably signals imminent use. Consuming it as a stream turns hours of warning into minutes of latency; polling turns it into a record of something that already happened.

Not this — Because the logs discard entries older than a few hours. CT logs are append-only and permanent. Nothing is discarded.

Not this — Because search APIs rate-limit frequent queries. They do, which is a practical reason to prefer a stream and not the reason the value decays.

Not this — Because certificates are logged only once per day. Submission is within minutes of issuance, which is precisely what makes the channel timely.

Last reviewed 2026-09-15