TLS certificate

A TLS certificate is the signed file a site presents when a browser connects. It names the hostnames it covers, the dates it is valid between, and the authority that signed it. The browser checks all three before it shows a page.

Four fields do the work:

• Subject Alternative Names, the list of hostnames it covers. See SAN certificate.
• Not before and not after, the validity window.
• Issuer, the certificate authority that signed it.
• The chain, the intermediate certificates connecting the issuer to a root the browser already trusts.

What Domduck records

The self_tls source connects to the domain once a day and records the issuer, the subject, every SAN, the validity window and the days remaining. The days-remaining figure is recomputed from the expiry date rather than stored, which is why it moves every day on a certificate that has not changed.

Domduck reads the certificate by connecting to the host, not by querying a third-party service. The connection goes through the same guard as every other source that takes a name from a user, because a handshake reports the issuer, the subject and every alternative name, and that is a richer answer than a normal fetch gives.

Why it matters

An issuer change is worth noticing. A certificate that was issued by one authority for two years and is suddenly signed by another usually means a migration, a proxy in front of the origin, or a control change. None of those is bad on its own, and all of them are worth knowing the date of.

The certificate also names hostnames, so it reveals which sites share a deployment. That is public information, presented by the server to anyone who connects, and it is often the fastest way to see that two domains are the same box.