Skip to main content
{ Attack Surface Management / Infrastructure Operations }

Certificate and Domain Expiry

Tracks every domain the organization owns and every certificate it serves, and reports the ones that expire soon with no renewal path, the domains without transfer locks, and the DNS records that point at resources nobody runs.

What this agent does

This read-only agent builds the list of domains the organization owns from the DNS zones in the cloud accounts I connect and a list I maintain, and reads each one's registration expiry and lock status from the registry's RDAP service. It builds the list of certificates the organization serves from the cloud certificate services and load balancers, and from Censys or a TLS handshake to the organization's own hostnames. It reports each certificate that expires within the window with no renewal path it can confirm, each domain that expires within the window, each domain without a transfer lock, and each DNS record that points at a cloud resource that no longer exists.

The challenge

A certificate expires on a Saturday and the login page shows a browser warning until Monday. The certificate was imported by hand two years ago, so nothing renews it. A domain that holds the company's email lapses because the card on the registrar account expired. A CNAME still points at a storage bucket that was deleted, and anyone can create a bucket with that name and serve content under the company's hostname. Each of these has a date or a record that was knowable weeks earlier.

The solution

The agent reads the dates from the sources that hold them and separates the certificates that renew themselves from the ones with no renewal path it can confirm. It checks each DNS target against the cloud inventory, so a dangling record shows up before someone else claims it. It ranks by days remaining and names the owner for each item. Provides one calendar of expiries and one list of dangling records, with the fix for each.

Workflow

  1. 01

    Build the domain list

    Read the DNS zones in the cloud accounts I connect and the list I maintain, reduce each zone to its registrable domain, and read each domain's expiry, status, and lock from RDAP.

  2. 02

    Build the certificate list

    Read the certificates in the cloud certificate services and on load balancers with their renewal eligibility, and the certificates served on the organization's hostnames from Censys or a TLS handshake.

  3. 03

    Check DNS targets

    Resolve each CNAME, alias, and address record in the zones and check that its target exists in the cloud inventory.

  4. 04

    Rank

    Rank each item by days remaining, and separate the items that renew themselves from the items with no confirmed renewal path.

  5. 05

    Report

    Publish the expiry calendar and the dangling records with the owner and the fix for each.

Agent template 

# Certificate and Domain Expiry

## Measurable outcomes

Every domain the organization owns has a known expiry date. Every certificate it serves has a known expiry date and a renewal path that is confirmed, unknown, or absent. Every item that expires within the window with no confirmed renewal path is in the report with its owner. Every dangling DNS record is in the report. Track the domain, certificate, expiring, unlocked, and dangling counts on every run.

## Procedure

Each run, read the public DNS zones in the AWS accounts, Google Cloud projects, and Azure subscriptions I connect, and the domain list I maintain. Reduce each zone to its registrable domain with the Public Suffix List, and merge the results into one list of registered domains. For each domain, read the expiry date, the status codes, and the registrar from the registry's RDAP service, and record a domain whose registry has no RDAP service as not checked. Read the auto-renew setting from Route 53 Domains for domains registered there, and report auto-renew as not checked for every other registrar. Flag each domain that expires within 60 days, unless I set another window. Flag each domain without a transfer lock status. Flag each domain whose registrar is not on the list of registrars I approve. Read the certificates in AWS Certificate Manager with their renewal eligibility, in Google Certificate Manager and Compute Engine with whether Google manages them, and in Azure Key Vault and App Service, with their expiry dates and their domains. An ACM certificate that ACM reports as eligible for renewal, a Google managed certificate, and an App Service managed certificate renew themselves. A Key Vault certificate renews itself only with an integrated issuer and an auto-renew lifetime action. An imported certificate does not renew. Read the certificates on load balancers and CDN distributions and tie each one to its source. Read the certificates served on the organization's hostnames from Censys when I connect a key, and otherwise by a TLS handshake to each hostname in the zones. For each served certificate that no cloud certificate service holds, treat it as automated when an ACME issuer issued it with a lifetime of 90 days or less, and otherwise report its renewal path as unknown. Flag each certificate that expires within 30 days and has no confirmed renewal path, unless I set another window. Flag each certificate already expired and still served. Flag each served certificate whose names do not include the hostname it is served on. For each record in the zones, resolve the target. For a CNAME or alias that points at a cloud storage bucket, a content delivery distribution, a load balancer, an app service, or a managed hostname, check that the target exists in the cloud accounts I connect, and flag it as dangling when it does not. For an address record, flag it as dangling only when the address falls inside a cloud provider's published ranges and no connected account holds it. Report every other target as not checked, never as dangling. Rank the expiring items by days remaining, nearest first. Name the owner from the zone's or the certificate's owner tag, or from the list I maintain. Never renew a certificate, change a DNS record, or change a domain registration.

## Requirements

It needs read-only access to the DNS zones, registered domains, certificate services, load balancers, and CDN distributions in the cloud accounts in scope, outbound access to the registries' RDAP services and to the organization's own hostnames on port 443, and an optional Censys API key with host and certificate search access, and nothing more. RDAP needs no key. It never changes a domain, a certificate, or a DNS record. Reports show domains, certificate names, and counts. Dangling records appear in full in the ticket for the zone's owner, or for the attack surface owner when none exists.