TLSCertificates and TLS
Know about every certificate issued in your name.
Every publicly trusted TLS certificate is written to a public log the moment it is issued. Nulink watches those logs for your domains, so a new hostname shows up the day its certificate is signed rather than the day it breaks. Then it does the other half: connecting to each live endpoint to see which protocol versions and cipher suites your servers are actually willing to accept, because a valid certificate on a host that still speaks TLS 1.0 is not a secure host.
What it finds
- Every certificate issued for your domains, as it appears in the transparency logs
- Certificates issued by an authority you do not normally use
- Certificates that have expired, and the ones about to
- Weak keys and outdated signature algorithms
- Deprecated protocol versions still enabled, such as TLS 1.0 and 1.1
- Weak cipher suites your servers still offer
- Hostnames that appear on a certificate before they appear anywhere else
Where the data comes from
- Certificate transparency logs
- Live TLS handshakes
How it works
- 01
Subscribe
Your verified domains are watched across the public certificate transparency logs.
- 02
Match
Each new certificate is matched to your domains and checked against the issuers you normally use.
- 03
Inspect
Live endpoints are connected to and assessed for expiry, key strength, protocol versions and cipher suites.
- 04
Alert
Unexpected certificates and approaching expiries are raised before they become incidents.
In detail
- The log tells you what exists
- Certificate transparency is a public, append-only record of every publicly trusted certificate. Nulink matches new entries against your verified domains, which means a subdomain created by a team that never told you still announces itself the moment it gets a certificate.
- The handshake tells you what it is worth
- A certificate being valid says nothing about the connection in front of it. Nulink connects to each live endpoint and records the protocol versions and cipher suites it accepts, so expiry monitoring and configuration review arrive as one finding list rather than two tools.
- An unexpected issuer is a signal
- A certificate for your domain from an authority you have never used is one of the clearest early indicators that something is wrong, whether that is a compromised DNS record or a team that went around procurement.
- Expiry, with enough warning
- Certificates expire at the worst possible moment, usually on a Saturday. Upcoming expiries are raised as findings while there is still time to renew them calmly.
What changes for your team
No surprise outages
An expiring certificate is a scheduled problem if you know about it and an incident if you do not.
Early warning of misuse
A certificate you did not request is one of the few genuinely early signals you get.
New hosts, found fast
A certificate is usually issued before the service goes live, which makes the logs the fastest discovery channel there is.
What it doesn't do
Every tool has edges. Knowing where ours are is the difference between a control you can rely on and one you only think you have.
- Certificate transparency covers publicly trusted certificates. A self-signed or privately issued certificate never appears in the logs, though Nulink still sees it on any live host it can reach.
- A wildcard certificate proves names exist under a domain without naming them, so Nulink leans on passive DNS and resolution to fill in which ones.
Questions about Certificates and TLS
We use wildcard certificates. Does that blind you?
It blinds the transparency logs, not the product. A wildcard tells you something exists under that domain without saying what, so the other discovery techniques, passive DNS, resolution, crawling and archives, do the naming instead. It is one of the reasons discovery never relies on a single source.
Do you check internal certificates?
Only if the host presenting them is reachable from the public internet. Internal PKI on internal systems is outside what an external view can or should see.
How soon do you see a new certificate?
Nulink reads the public logs on its scan schedule, so new certificates surface on the next run rather than within seconds of issuance. For most teams the useful comparison is against finding out months later, or not at all.
Ports, services and CVEs
ServicesSee which ports answer on your hosts, what runs behind them, and which versions have known CVEs.
Read more
Web exposure checks
WebCheck the headers, cookies, CORS policies and technology stack in front of every site you run.
Read more
DNS and email security
EmailCheck SPF, DMARC, DKIM and MX on every domain, including the ones you forgot you own.
Read more
Visibility is security. Start with yours.
Book a 30-minute walkthrough with the team, or connect your first account and see results today.