Certificates from a CA the domain does not allow

Compare the domain’s CAA record with a Certificate Transparency export, find certificates from another CA, and use the DNS change log to tell shadow IT from a CA that ignored CAA.

Terminal mission
Intermediate
4 objectives
0 of 4 solved

Briefing

corp.example publishes a CAA record so that only one certificate authority may issue for it. A CT monitor exported every certificate logged for the domain this quarter.

CAA is checked by the CA at issuance time. A certificate issued before the record existed did not break any rule; one issued after it did, or the record was not what you think.

analyst@soc-ws

soc-ws · DNS investigation

Type help for the command list and objectives for your tasks. Everything runs in this browser.

analyst@soc-ws:~/certs$

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.