NOTE: This article was written with generative AI.

Occurative is releasing PKICTSearcher, a lightweight command-line utility designed to help security practitioners search public Certificate Transparency (CT) data for TLS certificates associated with a domain.

PKICTSearcher is an open-source Occurative project available on GitHub:

github.com/0xF21D/PKICTSearcher

The utility is a dependency-free Python CLI that searches for unexpired TLS certificate issuances associated with a domain. It uses the SSLMate Certificate Transparency Search API, which indexes public CT logs and consolidates matching certificate and precertificate records into individual issuance records. 

Why Certificate Transparency Matters

Certificate Transparency logs provide defenders with another source of externally observable information about their infrastructure.

When a publicly trusted TLS certificate is issued, information about that certificate is normally recorded in publicly accessible CT logs. Those records can reveal hostnames and subdomains that may otherwise be difficult to identify through DNS enumeration or conventional asset-discovery techniques.

For defenders, this makes CT data useful for activities such as:

• External attack-surface discovery
• Identifying previously unknown subdomains
• Certificate inventory and monitoring
• Investigating unexpected certificate issuance
• Threat hunting and reconnaissance
• Asset validation
• OSINT collection

PKICTSearcher provides a simple way to incorporate this data source into an analyst’s workflow.

Simple by Design

PKICTSearcher was intentionally designed as a small utility rather than a large framework.

At runtime it uses only the Python standard library, eliminating the dependency chains frequently associated with Python security tools. It requires Python 3.10 or newer.

A basic search is straightforward:

pkictsearcher example.com

By default, PKICTSearcher searches the specified domain along with its subdomains and includes matching wildcard certificates.

This makes it useful for quickly answering questions such as:

What certificates are currently visible in Certificate Transparency data for this organization?

or:

Are there hostnames appearing in certificates that are missing from my current asset inventory?

Features

PKICTSearcher currently provides several capabilities intended to make CT searches practical for both interactive investigation and automation.

It can:

• Search a domain and its subdomains by default
• Match wildcard certificates
• Automatically follow Certificate Transparency Search API pagination
• Deduplicate issuance records using their TBSCertificate SHA-256 digest
• Produce human-readable tables
• Export results as JSON
• Export results as CSV
• Normalize Unicode domains into their Punycode representation
• Operate without third-party Python runtime dependencies citeturn624361view0

The JSON and CSV output modes are particularly useful when PKICTSearcher is incorporated into scripts, asset-management workflows, threat-hunting pipelines, or other security tooling.

Installation

PKICTSearcher can be installed directly from the GitHub repository:

git clone https://github.com/0xF21D/PKICTSearcher.git
cd PKICTSearcher
python -m pip install .

For development work, the project can also be installed in editable mode:

python -m pip install -e .

Once installed, the pkictsearcher command becomes available from the command line. 

Example Searches

A normal domain search:

pkictsearcher example.com

This searches the domain, its subdomains, and matching wildcard names.

To restrict the search to the exact domain and return JSON:

pkictsearcher example.com --exact --format json

To retrieve up to 50 unique results and save them as CSV:

pkictsearcher example.com --limit 50 --format csv --output certificates.csv

The package can also be executed directly through Python without installing the console command:

python -m pkictsearcher example.com

Additional options are available through:

pkictsearcher --help

These usage patterns are documented in the project’s README. 

Using PKICTSearcher for Defensive Reconnaissance

One of the more useful applications of CT data is validating an organization’s externally visible asset inventory.

Consider an organization that believes its public Internet footprint consists of:

www.example.com
vpn.example.com
mail.example.com

A CT search may reveal additional names such as:

dev.example.com
staging.example.com
legacy-api.example.com
remote.example.com

Those findings do not necessarily indicate that the systems are online. They do, however, provide leads worth investigating.

For a blue team or attack-surface-management program, that can help identify:

• Forgotten infrastructure
• Development or staging environments
• Legacy hostnames
• Third-party hosted systems
• Unexpected certificate requests
• Assets absent from a CMDB or other inventory

PKICTSearcher is intended to make that investigative step quick enough to become part of routine defensive reconnaissance.

A Note About CT Data

Certificate Transparency should be treated as an intelligence source rather than an authoritative inventory.

PKICTSearcher currently queries the SSLMate CT Search API for unexpired certificate issuances. A domain not appearing in the results does not establish that a certificate was never issued for it. Likewise, the presence of a certificate does not prove that the associated host is currently online, reachable, owned by the expected organization, or trustworthy. citeturn624361view0

As with most OSINT and reconnaissance data, findings should be correlated with other sources such as DNS, network observations, asset inventories, and historical records.

API Access

The SSLMate CT Search API supports a limited number of unauthenticated domain searches for personal or evaluation purposes. For authenticated or production use, PKICTSearcher supports supplying an SSLMate API key through the PKICTSEARCHER_API_KEY environment variable. 

For example:

export PKICTSEARCHER_API_KEY="your-api-key"
pkictsearcher example.com

Using an environment variable also avoids placing the API key directly into shell command history.

Part of the Occurative Project

PKICTSearcher reflects the direction of Occurative’s security tooling: focused utilities designed around practical defensive-security problems.

Rather than attempting to replace existing asset-management or threat-intelligence platforms, PKICTSearcher does one specific job: make Certificate Transparency data easy to query from the command line and easy to consume programmatically.

The project is open source and released under the MIT License. 

Source code, installation instructions, and documentation are available on GitHub:

PKICTSearcher on GitHub

As the project evolves, additional capabilities may be added based on practical defensive-security and reconnaissance use cases.

If you work in blue-team operations, attack-surface management, PKI, threat hunting, or security research, give PKICTSearcher a try—and contributions, issues, and feedback are welcome.

AI disclosure: This introductory article was written using artificial intelligence based on direction provided by Occurative.

Cybersecurity is shaped by constant change. New vulnerabilities emerge, threat actors adapt, defensive technologies evolve, and artificial intelligence continues to alter both sides of the security landscape. The Occurative Cybersecurity Blog was created to document these changes, share practical knowledge, and provide a thoughtful perspective on the issues affecting defenders.

Occurative is focused on defensive cybersecurity—the technologies, research, and practices that help organizations better understand threats and protect their systems. This blog will serve as a public record of that work and a place to explore the broader cybersecurity landscape.

What You Can Expect

Project Updates

We will share updates about Occurative projects, experiments, tools, research, and services as they develop. These posts may include design decisions, technical lessons, development milestones, and challenges encountered along the way.

Our goal is to provide more than announcements. Whenever possible, project updates will explain what we are building, why we believe it matters, and what we learn during the process.

Cybersecurity Awareness

Cybersecurity affects everyone—not only security professionals. We will publish approachable articles intended to help individuals, businesses, and technical teams better understand common threats and make informed security decisions.

Topics may include phishing, credential theft, ransomware, online privacy, vulnerability management, secure configuration, and emerging attack techniques. We want to make cybersecurity easier to understand without oversimplifying the risks.

Whitepapers and Technical Research

Occurative will publish whitepapers and longer-form research covering defensive security technologies, threat activity, security architecture, and other areas requiring more detailed analysis.

These publications will emphasize evidence, clearly identified assumptions, reproducible methods when practical, and useful conclusions for cybersecurity practitioners.

Opinions on Cybersecurity Topics

Not every important cybersecurity question has a purely technical answer. Security decisions are influenced by business priorities, public policy, technology vendors, economics, ethics, and human behavior.

This blog will include opinion and analysis on significant cybersecurity topics. Opinion articles will be clearly presented as such and will aim to encourage constructive discussion rather than simply repeat conventional industry viewpoints.

AI-Generated Articles

Artificial intelligence will be both a subject of this blog and a tool used to help create some of its content. AI may assist with research organization, drafting, editing, summarization, and exploring alternative perspectives.

When AI materially contributes to an article, we intend to disclose that involvement. AI-generated content can be useful, but it can also contain errors, omit context, or present uncertain information too confidently. Its output should therefore be reviewed critically—especially when discussing vulnerabilities, threat intelligence, or defensive recommendations.

Cyber Threat Intelligence

Cyber threat intelligence, or CTI, will be a central area of coverage. CTI articles may examine threat actors, campaigns, vulnerabilities, malware, attacker infrastructure, indicators of compromise, and changes in adversary tactics, techniques, and procedures.

The emphasis will be on intelligence that helps defenders make decisions. Whenever possible, reporting will distinguish among confirmed facts, credible assessments, unverified claims, and the author’s own analysis. Sources and confidence levels will be included when they are relevant and available.

Building a Useful Resource for Defenders

The Occurative Cybersecurity Blog is intended to become a practical resource for security professionals, technology leaders, researchers, and anyone interested in understanding the modern threat landscape.

Cybersecurity does not improve through fear, hype, or opaque claims. It improves through careful observation, open discussion, experimentation, and the responsible exchange of knowledge. Those principles will guide what we publish here.

This is the beginning. Future posts will introduce Occurative projects, examine current threats, share defensive research, and explore how cybersecurity is changing in an increasingly AI-enabled world.