Certificate Transparency log monitor
Project homepage: https://github.com/SSLMate/certspotter
Description
Cert Spotter is a Certificate Transparency log monitor from SSLMate that alerts
you when an SSL/TLS certificate is issued for one of your domains.
Cert Spotter is easier to use than other open source CT monitors, since it does
not require a database. It's also more robust, since it uses a special
certificate parser that ensures it won't miss certificates.
You can use Cert Spotter to detect:
- Certificates issued to attackers who have compromised your DNS
and are redirecting your visitors to their malicious site.
- Certificates issued to attackers who have taken over an abandoned
sub-domain in order to serve malware under your name.
- Certificates issued to attackers who have compromised a certificate
authority and want to impersonate your site.
- Certificates issued in violation of your corporate policy or outside
of your centralized certificate procurement process.
N.B. Cert Spotter fetches the entire set of CT logs, using a large
amount of bandwidth while doing so, possibly for a week or more.
Package information
- Ports path
- security/certspotter
- Package architecture
- amd64
- Maintainer
- Renaud Allard <renaud@allard.it>
- Categories
- security, lang/go
- Available flavors
- None listed
- Only for architectures
- aarch64, amd64, mips64, riscv64
Ports list build and test dependencies as well as runtime dependencies. pkg_add selects those needed for installation.
Direct dependencies
Build
OpenBSD README
This README contains unresolved ports variables; replace them before using its commands.
+-------------------------------------------------------------------------------
| Running certspotter on OpenBSD
+-------------------------------------------------------------------------------
Create a watch list file ${LOCALSTATEDIR}/certspotter/.certspotter/watchlist
containing the DNS names you want to monitor, one per line. To monitor an
entire domain tree (including the domain itself and all sub-domains) prefix the
domain (including the domain itself and all sub-domains) prefix the domain name
with a dot (e.g. .example.com). To monitor a single DNS name only, do not
prefix the name with a dot.
Place one or more email addresses in
${LOCALSTATEDIR}/certspotter/.certspotter/email_recipients file
(one per line), and/or place one or more executable scripts in
${LOCALSTATEDIR}/certspotter/.certspotter/hooks.d directory. certspotter
will email the listed addresses (requires your system to have a working
sendmail command) and execute the provided scripts when it detects a
certificate for a domain on your watch list. The location of those files is
kept in a .certspotter to ensure compatibility with the non daemonized
version.