Skip to content

SSL Profile

The SSL Profile panel provides SSL/TLS certificate details for a domain, including validity dates, issuer, subject, and alternative names. Use certificate attributes as pivots to discover related infrastructure.

What's included

The SSL Profile displays:

  • Certificate validity: Not Before and Not After dates
  • Issuer: Certificate Authority that issued the certificate
  • Subject: Entity the certificate was issued to
  • Subject Alternative Names (SANs): Additional domains covered by the certificate
  • Certificate hash: SHA-1 fingerprint
  • Public key: Key algorithm and size
  • Signature algorithm: Algorithm used to sign the certificate
  • Extensions: Additional certificate attributes

Multiple certificates

When DomainTools finds more than one certificate on a domain, Iris Investigate shows the certificates in separate tabs. Navigate between tabs to view different certificates.

Pivot on certificate attributes

The SSL Profile provides multiple pivot opportunities:

Subject Alternative Names

The Extensions → Subject Alt Name section lists all domains covered by the certificate:

  1. Right-click a domain in the Subject Alt Names list.
  2. The Operations Menu appears.
  3. Select a pivot operation.

To examine all domains covered by a certificate:

  1. Locate the ADD TO FILTERS button in the Subject Alt Names section.
  2. Select ADD TO FILTERS.
  3. All domains from the certificate populate your search filters.

Certificate hash

Pivot on the certificate hash to find other domains using the same certificate:

  1. Right-click the certificate hash.
  2. Select a pivot operation from the Operations Menu.
  3. Discover domains sharing the certificate.

Other attributes

Pivot on additional certificate attributes:

  • Issuer: Find certificates from the same CA
  • Subject Organization: Discover related entities
  • Certificate email: Search by contact email

SSL certificate collection

DomainTools employs three methods to gather certificate data:

  1. Certificate Transparency Logs: Constantly monitored for newly published certificates
  2. Web Crawler: Collects certificates when gathering web-related data
  3. Active certificate crawls: Weekly attempts to gather certificates for identified domains

For complete details on collection and validation, see SSL Certificate Collection.

Update content

The SSL Profile includes an Update Content button to manually trigger certificate collection:

  1. Navigate to the SSL Profile.
  2. Select Update Content.
  3. The system queues the domain for certificate collection.

Use cases

Discover shared infrastructure

Find domains using the same certificate:

  • Shared hosting environments
  • Related domains under common ownership
  • Infrastructure patterns

Track certificate changes

Monitor certificate lifecycle:

  • Certificate renewals
  • CA changes
  • Subject or SAN modifications

Identify suspicious patterns

Look for indicators of malicious activity:

  • Self-signed certificates
  • Unusual issuers
  • Mismatched subject information
  • Suspicious SANs

Best practices

Certificate analysis

  1. Check validity dates: Expired or future-dated certificates may indicate issues.
  2. Verify issuer: Legitimate CAs vs. self-signed or unusual issuers.
  3. Review SANs: Look for unexpected domains in the certificate.
  4. Compare with domain: Ensure certificate matches the domain.

Investigation workflow

  1. Review Domain Profile: Get overview.
  2. Open SSL Profile: Examine certificate details.
  3. Check SANs: Identify related domains.
  4. Pivot on hash: Find domains sharing the certificate.
  5. Document findings: Note suspicious patterns.

What to look for

Legitimate patterns:

  • Valid certificates from recognized CAs
  • Appropriate subject information
  • Expected SANs
  • Regular renewal patterns

Suspicious patterns:

  • Self-signed certificates
  • Expired or invalid certificates
  • Mismatched subject information
  • Unusual SANs
  • Shared certificates across unrelated domains

Limitations

  • Certificate collection depends on domain accessibility
  • Some certificates may not be collected if domains are unreachable
  • Historical certificate data availability varies

See also