CertaDNS
Skip to lesson

Certificates as a Channel · lesson 2 of 2

The volume problem

After this lesson you can

Design a CT query that produces findings rather than a firehose.

Assumes you have read Reading a log entry.

Certificate Transparency logs record millions of certificates a day. A naive brand query returns a stream nobody can work, and the tuning that makes it usable is where most CT monitoring succeeds or fails.

Where the noise comes from

SourceWhy it floods
RenewalsA 90-day certificate renewed automatically produces an entry every 60 days, for every name you own.
PrecertificatesEach issuance is logged twice — a precertificate and the certificate. Naive counting doubles everything.
Multiple logsThe same certificate is submitted to several logs, so it appears several times.
Substring matchesA brand string that is also a common word matches thousands of unrelated names.
Your own infrastructureEvery subdomain you legitimately certify appears, forever, on every renewal.

Making it usable

1. Deduplicate by certificate fingerprint.
   Kills the precertificate and multi-log duplication
   at a stroke — usually a 3-4x reduction.

2. Allowlist names you control.
   Your own renewals are the single largest source of
   volume and carry no information.

3. Alert on FIRST SEEN only.
   A name that appeared last month reappearing on
   renewal is not a new finding.

4. Match on the permutation watchlist, not on a
   substring of the brand.
   Substring matching is what produces the firehose.

5. Escalate on the combination, not the entry.
   new name + resolves + MX  ->  page someone
   new name only             ->  queue it

Substring matching is the trap

  • A brand string that appears inside ordinary words matches endlessly — %northwind% also matches northwinds-sailing-club.example.
  • Matching against the cut-down permutation watchlist instead turns an unbounded query into a bounded one.
  • Keep a small substring query as a secondary, low-priority feed. It catches combosquats the generator never produced, and it should never page anyone.

Measure the queue, not the coverage

The useful metric is how many CT findings a human looked at last week and what fraction led to action. A programme reporting ten thousand matched entries and two investigations has a tuning problem, not a coverage success — and the fix is always at steps 1 to 4 above rather than in more monitoring.

Last reviewed