# Analyzing Tls Certificate Transparency Logs

> 通过 crt.sh 和 pycrtsh 查询证书透明度（Certificate Transparency）日志，检测钓鱼域名、未授权证书签发和影子 IT。使用 Levenshtein 距离监控新签发证书中的仿域名和品牌仿冒行为。适用于主动检测钓鱼域名和证书监控。

- Skill: `killvxk/analyzing-tls-certificate-transparency-logs` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add killvxk/analyzing-tls-certificate-transparency-logs`
- Raw SKILL.md: https://api.skillmd.com/api/skills/killvxk/analyzing-tls-certificate-transparency-logs/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: Apache-2.0
- Author: killvxk (https://skillmd.com/u/killvxk)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/killvxk/analyzing-tls-certificate-transparency-logs

---


# 分析 TLS 证书透明度日志

## 使用说明

通过查询 crt.sh 证书透明度数据库，查找针对您组织品牌相似域名签发的证书，检测钓鱼基础设施。

```python
from pycrtsh import Crtsh

c = Crtsh()
# 搜索与域名匹配的证书
certs = c.search("example.com")
for cert in certs:
    print(cert["id"], cert["name_value"])

# 获取完整证书详情
details = c.get(certs[0]["id"], type="id")
```

关键分析步骤：
1. 查询 crt.sh 获取与您的域名模式匹配的所有证书
2. 使用 Levenshtein 距离识别仿域名变体
3. 标记来自非预期 CA 的证书
4. 监控可疑子域名上的通配符证书
5. 与已知钓鱼基础设施进行交叉验证

## 示例

```python
from pycrtsh import Crtsh
c = Crtsh()
certs = c.search("%.example.com")
for cert in certs:
    print(f"签发者: {cert.get('issuer_name')}, 域名: {cert.get('name_value')}")
```