CertPatrol / Open-source domain monitoring

Follow the certificate trail.

A lightweight Certificate Transparency log tailer.
Monitor new certificates, filter domains with regex,
and investigate from your terminal.

Install CertPatrol View on GitHub

Public signals.
Local investigation.How it works

CertPatrol — zshExample

$ pip install certpatrol
$ certpatrol --pattern ".*\.example\.com$"

# Illustrative matching domains
api.example.com
shop.example.com
status.example.com

Public certificate data. Your patterns and processing stay local.

01 / How it works

A public trail.
A sharper view.

For domain monitoring, brand protection, security research, and finding newly issued certificates for subdomains.

01 / Watch

Follow new certificates.

Monitor public Certificate Transparency logs with configurable polling intervals. Persistent checkpoints let you resume where you left off.

02 / Filter

Focus on your patterns.

Use regular expressions to match domains. Customize patterns, batch sizes, and log selection. Run multiple instances for separate searches.

03 / Investigate

Keep processing local.

Fetch public log data and match it on your own machine. Work from your terminal, with your search patterns under your control.

02 / Get started

From installation
to investigation.

Install with pip, choose a pattern, and start watching. These commands also provide a starting point for more specific searches.

Certificate log entries passing through a local regex filter. — Concept illustration

Install from PyPI

pip install certpatrol

Start monitoring

certpatrol --pattern "your-pattern"

Match API subdomains

certpatrol --pattern "api.*\.google\.com$"

Run multiple instances

certpatrol --pattern "domain1" &
certpatrol --pattern "domain2" &

Install from source

git clone https://github.com/ToritoIO/CertPatrol.git
cd CertPatrol
pip install -r requirements.txt
python certpatrol.py --pattern "your-pattern"

03 / Field notes

A few things
worth knowing.

What is a CT log used for?

A Certificate Transparency (CT) log is a publicly verifiable, append-only, and tamper-proof log that records all SSL/TLS certificates issued by Certificate Authorities (CAs). It creates a public record of all certificates, helping detect and prevent unauthorized or malicious certificate issuance. This transparency allows domain owners and security teams to monitor for certificates they didn't authorize.

What is the meaning of a CT certificate?

A "CT certificate" isn't a different type of certificate—it's a standard SSL/TLS certificate that has been logged in Certificate Transparency logs. When a CA issues a certificate, it submits it to public CT logs, which return a Signed Certificate Timestamp (SCT). This SCT is embedded in the certificate, and major browsers like Chrome now require valid SCTs for certificate acceptance.

What is CT log monitoring?

CT log monitoring is the process of actively watching Certificate Transparency logs to detect certificate issuance for your domain names. This allows domain owners to quickly identify unauthorized certificates that may have been issued by compromised CAs or through fraudulent processes. Tools like CertPatrol automate this monitoring with real-time alerts.

How to check certificate transparency logs?

You can check CT logs using various online tools and services—many offer simple lookup features where you enter a domain name to see all logged certificates. For continuous monitoring, specialized tools like CertPatrol provide automated monitoring and alerting, eliminating the need for manual log checking.

How to monitor SSL certificates?

SSL certificate monitoring involves more than checking expiration dates—it includes verifying correct certificate usage and detecting unauthorized issuance. The most effective approach combines CT log monitoring for unauthorized certificates with tracking of certificate expiration and proper SSL/TLS configuration to ensure complete website security.

What is certificate monitoring?

Certificate monitoring refers to using Certificate Transparency to track all certificates issued for your domains. This monitoring process ensures only authorized and legitimate certificates are used for your services, providing an early warning system for potential security threats and certificate misuse.

How do you investigate an SSL certificate?

To investigate an SSL certificate, check its details including issuer, validity dates, and domain names using browser tools or online SSL checkers. For investigating unauthorized certificates, examine Certificate Transparency logs. Monitoring services like CertPatrol can alert you to unexpected or suspicious certificates that require further investigation.

Open source. Open to exploration.

Good security starts
with a closer look.

View CertPatrol on GitHub