CertGraph

CertGraph is a tool designed for host name enumeration via SSL certificates. It crawls certificates to create a directed graph where domains are nodes and alternative names in certificates form edges to other domains. New domains are printed as discovered, and in detailed mode, the graph's adjacency list is output upon completion.

The tool supports multiple drivers, defaulting to TCP connections for certificate collection, but can search Certificate Transparency logs. It helps uncover relationships between domains through shared certificates, showing chains of trust.

Use cases include reconnaissance for bug bounties, security assessments, and mapping certificate reuse across domains.

CertGraph performs a breadth-first search (BFS) starting from given hosts, with a default maximum depth of 5. It connects over TCP by default to fetch certificates or uses Certificate Transparency log drivers. Domains from Subject Alternative Names (SANs) become graph edges. Expired certificates and subdomains can be included via specific flags, with CDN certificates optionally added.