Introducing PKICTSearcher: Certificate Transparency Search for Defenders

NOTE: This article was written with generative AI.

Occurative is releasing PKICTSearcher, a lightweight command-line utility designed to help security practitioners search public Certificate Transparency (CT) data for TLS certificates associated with a domain.

PKICTSearcher is an open-source Occurative project available on GitHub:

github.com/0xF21D/PKICTSearcher

The utility is a dependency-free Python CLI that searches for unexpired TLS certificate issuances associated with a domain. It uses the SSLMate Certificate Transparency Search API, which indexes public CT logs and consolidates matching certificate and precertificate records into individual issuance records. 

Why Certificate Transparency Matters

Certificate Transparency logs provide defenders with another source of externally observable information about their infrastructure.

When a publicly trusted TLS certificate is issued, information about that certificate is normally recorded in publicly accessible CT logs. Those records can reveal hostnames and subdomains that may otherwise be difficult to identify through DNS enumeration or conventional asset-discovery techniques.

For defenders, this makes CT data useful for activities such as:

• External attack-surface discovery
• Identifying previously unknown subdomains
• Certificate inventory and monitoring
• Investigating unexpected certificate issuance
• Threat hunting and reconnaissance
• Asset validation
• OSINT collection

PKICTSearcher provides a simple way to incorporate this data source into an analyst’s workflow.

Simple by Design

PKICTSearcher was intentionally designed as a small utility rather than a large framework.

At runtime it uses only the Python standard library, eliminating the dependency chains frequently associated with Python security tools. It requires Python 3.10 or newer.

A basic search is straightforward:

pkictsearcher example.com

By default, PKICTSearcher searches the specified domain along with its subdomains and includes matching wildcard certificates.

This makes it useful for quickly answering questions such as:

What certificates are currently visible in Certificate Transparency data for this organization?

or:

Are there hostnames appearing in certificates that are missing from my current asset inventory?

Features

PKICTSearcher currently provides several capabilities intended to make CT searches practical for both interactive investigation and automation.

It can:

• Search a domain and its subdomains by default
• Match wildcard certificates
• Automatically follow Certificate Transparency Search API pagination
• Deduplicate issuance records using their TBSCertificate SHA-256 digest
• Produce human-readable tables
• Export results as JSON
• Export results as CSV
• Normalize Unicode domains into their Punycode representation
• Operate without third-party Python runtime dependencies citeturn624361view0

The JSON and CSV output modes are particularly useful when PKICTSearcher is incorporated into scripts, asset-management workflows, threat-hunting pipelines, or other security tooling.

Installation

PKICTSearcher can be installed directly from the GitHub repository:

git clone https://github.com/0xF21D/PKICTSearcher.git
cd PKICTSearcher
python -m pip install .

For development work, the project can also be installed in editable mode:

python -m pip install -e .

Once installed, the pkictsearcher command becomes available from the command line. 

Example Searches

A normal domain search:

pkictsearcher example.com

This searches the domain, its subdomains, and matching wildcard names.

To restrict the search to the exact domain and return JSON:

pkictsearcher example.com --exact --format json

To retrieve up to 50 unique results and save them as CSV:

pkictsearcher example.com --limit 50 --format csv --output certificates.csv

The package can also be executed directly through Python without installing the console command:

python -m pkictsearcher example.com

Additional options are available through:

pkictsearcher --help

These usage patterns are documented in the project’s README. 

Using PKICTSearcher for Defensive Reconnaissance

One of the more useful applications of CT data is validating an organization’s externally visible asset inventory.

Consider an organization that believes its public Internet footprint consists of:

www.example.com
vpn.example.com
mail.example.com

A CT search may reveal additional names such as:

dev.example.com
staging.example.com
legacy-api.example.com
remote.example.com

Those findings do not necessarily indicate that the systems are online. They do, however, provide leads worth investigating.

For a blue team or attack-surface-management program, that can help identify:

• Forgotten infrastructure
• Development or staging environments
• Legacy hostnames
• Third-party hosted systems
• Unexpected certificate requests
• Assets absent from a CMDB or other inventory

PKICTSearcher is intended to make that investigative step quick enough to become part of routine defensive reconnaissance.

A Note About CT Data

Certificate Transparency should be treated as an intelligence source rather than an authoritative inventory.

PKICTSearcher currently queries the SSLMate CT Search API for unexpired certificate issuances. A domain not appearing in the results does not establish that a certificate was never issued for it. Likewise, the presence of a certificate does not prove that the associated host is currently online, reachable, owned by the expected organization, or trustworthy. citeturn624361view0

As with most OSINT and reconnaissance data, findings should be correlated with other sources such as DNS, network observations, asset inventories, and historical records.

API Access

The SSLMate CT Search API supports a limited number of unauthenticated domain searches for personal or evaluation purposes. For authenticated or production use, PKICTSearcher supports supplying an SSLMate API key through the PKICTSEARCHER_API_KEY environment variable. 

For example:

export PKICTSEARCHER_API_KEY="your-api-key"
pkictsearcher example.com

Using an environment variable also avoids placing the API key directly into shell command history.

Part of the Occurative Project

PKICTSearcher reflects the direction of Occurative’s security tooling: focused utilities designed around practical defensive-security problems.

Rather than attempting to replace existing asset-management or threat-intelligence platforms, PKICTSearcher does one specific job: make Certificate Transparency data easy to query from the command line and easy to consume programmatically.

The project is open source and released under the MIT License. 

Source code, installation instructions, and documentation are available on GitHub:

PKICTSearcher on GitHub

As the project evolves, additional capabilities may be added based on practical defensive-security and reconnaissance use cases.

If you work in blue-team operations, attack-surface management, PKI, threat hunting, or security research, give PKICTSearcher a try—and contributions, issues, and feedback are welcome.