Malte ZanderContents
- What does a certificate reveal about a fake site?
- How do you find the certificate?
- What do the names in the certificate say?
- What does the issue date say?
- How do certificate logs warn you about new fakes?
- Is the certificate authority a takedown channel?
- What goes into the evidence package?
- How does AI Fraud Protect help?
- FAQ
A fake site's TLS certificate shows when it was issued, by which certificate authority and for which names. Those names often reveal other domains of the same operator, and the issue date helps narrow down when the attack was prepared. Because publicly trusted certificates must appear in Certificate Transparency logs, you can also find new certificates that use your brand name there, often before the fake goes live.
- Chrome only trusts publicly issued TLS certificates that appear in Certificate Transparency logs (Chrome).
- Public TLS certificates issued since 15 March 2026 may be valid for at most 200 days. The limit drops to 100 days in March 2027 and to 47 days in March 2029 (CA/Browser Forum).
- The research system Phishpedia checked new domains from the certificate log stream and found 1,704 phishing sites in one month, 1,133 of them previously unknown (Phishpedia).
What does a certificate reveal about a fake site?
More than the padlock in the address bar suggests. A TLS certificate only confirms that the applicant controls the domain, not who they are or whether the site is legitimate. For investigations it's a goldmine all the same:
| Field | What it shows | What it tells you |
|---|---|---|
| Issuer | The certificate authority | Which authority issued the certificate, and how |
| Valid from | Time of issue | When the operator prepared the site |
| Valid to | Expiry | How long they plan to run at least, without a new certificate |
| Alternative names | Every domain and subdomain in the certificate | Further addresses of the same operator |
| Serial number and fingerprint | A unique identifier | A precise reference in reports and files |
| Transparency log entries | When the certificate was publicly logged | An independent timestamp |
How do you find the certificate?
In two ways, without having to use the site itself:
In the browser: clicking the icon next to the address shows details of the connection and the certificate. Only open the fake in an isolated environment for this, and don't enter anything.
In the transparency logs: public search services such as crt.sh search Certificate Transparency logs by domain name. There you'll also find certificates for domains that are currently unreachable, and older certificates for the same domain.
The second route is usually better for investigations, because it shows a domain's history and doesn't require contact with the fake.
What do the names in the certificate say?
Often more than the domain itself. A certificate can cover many names. Operators sometimes put several lookalike domains or subdomains into one certificate, such as your-brand-login.com, your-brand-verify.com and your-brand-support.com. That reveals addresses that aren't even in use yet. Check every name on the list and put suspicious ones on your watchlist. How to connect such finds with other cases is shown in Linking cases.
What does the issue date say?
It narrows down the timeframe. If the certificate was issued two days before the first phishing email, the operator prepared the site in those two days. If it was issued weeks earlier, the domain may have been waiting for its use for some time. Together with the creation date from RDAP, you get a timeline that belongs in every report and every evidence package.
Since March 2026, public certificates have been valid for at most 200 days, and the limit keeps falling. For investigations, that means operators have to renew certificates more often, and every renewal appears in the logs. A fake that runs for months leaves a trail there.
How do certificate logs warn you about new fakes?
When you search new entries for your brand name continuously. Almost every fake uses HTTPS so that browsers don't warn about an insecure connection. The certificate is therefore usually created before the first victim. If you watch the logs, you often see suspicious names before the site is live. The Phishpedia research project showed the principle: it checked new domains from the certificate log stream and found 1,704 phishing sites in one month (Phishpedia).
Expect noise. Many hits are harmless, such as your own certificates, your partners' or chance name matches. An ignore list and a human review belong in the process, more in Avoiding false positives.
Is the certificate authority a takedown channel?
Rarely the right one. A domain-validated certificate only confirms control of the domain. Even if a certificate is revoked, the site stays reachable at its address, and the operator gets a new one in minutes. Focus your reports on the host, the registrar and browser warnings, as described in How to take down a fake website. The certificate belongs in the evidence package, not in the reporting route.
What goes into the evidence package?
The issuer, serial number, fingerprint, validity period, the full list of names and the link to the transparency log entry. Also save the certificate itself as a file. The other components are in Securing evidence of a fake website.
How does AI Fraud Protect help?
AI Fraud Protect finds lookalike domains, cloned websites, phishing pages and fake verification pages that use your name, and adds the certificate data to every case's evidence package automatically. Reports to the host, registrar, DNS provider and Google Safe Browsing are prepared, and a person reviews and sends every message.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedown in the app.
FAQ
Does a padlock in the address bar mean the site is genuine?
No. The padlock only shows an encrypted connection to the domain in the address bar. Almost every fake has one.
Can I find out who applied for a certificate?
Not from a domain-validated certificate itself. It contains no details about the person. Registration data, hosting and links to other cases are more likely to provide clues.
Why does a fake site have a certificate from a reputable authority?
Because domain-validated certificates are issued automatically, and often for free, as soon as someone proves control of the domain. That's by design and applies to genuine and fake sites alike.
How often should I check the certificate logs?
Continuously, automated if possible. New certificates appear every day, and an early find buys time before the first phishing email goes out.
Sources
CA/Browser Forum: Ballot SC081v3, schedule of reducing validity and data reuse periods, 11 April 2025
Phishpedia: A Hybrid Deep Learning Based Approach to Visually Identify Phishing Webpages, USENIX Security 2021