Domain name evidence, forensics and litigation support
Abstract vertical bar illustration representing SSL Certificate Timeline Analysis

EvidenceDocumentary

SSL Certificate Timeline Analysis

Produces
A dated timeline of certificate issuance for a domain
Sources
Certificate Transparency logs, retrieved via public monitors
How it is obtained
Publicly retrievable; CA validation records need legal process
Authority
RFC 9162; Chrome and Apple CT policies; FRE 901, 902(13)

Certificate Transparency as a dated record of when someone demonstrated control of a domain name

What a certificate log entry proves

A Certificate Transparency entry — an entry in a public, append-only log of issued TLS certificates — proves that a publicly trusted certificate covering a particular hostname was issued by a particular certificate authority and logged at a particular time. Read precisely, it is evidence that somebody demonstrated control of that name to a CA on that date. It does not say who.

That narrow fact is often exactly the fact in issue. Control is what changes in a hijacking. Control is what a respondent claims to have had, and when. Control is what a complainant says was taken. A certificate log gives a dated, independently held, cryptographically structured record bearing on that question, produced by parties with no interest in the dispute, and it is one of the few records in this field that a party cannot quietly edit after the fact.

The related terms: a certificate authority is the organization that issues certificates after checking that an applicant controls the name; domain control validation is that check; and a Subject Alternative Name list is the set of hostnames a single certificate covers.

How Certificate Transparency works

The standard describes CT as a framework for publicly logging TLS server certificates as they are issued or observed, so that anyone can audit certificate authority activity and notice the issuance of suspect certificates (RFC 9162, which supersedes RFC 6962). Each log entry carries a timestamp in milliseconds, a hash binding the issuing CA to the entry, and the encoded certificate data from the submission.

Two structural features matter for evidence. First, a Signed Certificate Timestamp is the log's signed cryptographic promise to append an entry, carrying the log's identity, a timestamp and a signature; the log must fulfill that promise within a defined maximum merge delay. Second, logs are built as binary Merkle trees, in which each node hashes its children, enabling efficient proofs that the log is append-only and preventing retroactive insertion of entries.

Browsers are what make logging near-universal. Chrome requires all publicly trusted TLS certificates issued after April 30, 2018 to support CT in order to be recognized as valid, with a minimum number of timestamps from distinct logs and operators; Apple's policy sets a comparable requirement.

Building the timeline

The working product is a chronology of issuance for the name and its subdomains. For each certificate I record the issuing CA; the notBefore and notAfter dates; the complete Subject Alternative Name list; the serial number; the SHA-256 fingerprint; every signed timestamp with its log identity; and whether the entry is a precertificate (a placeholder logged before the final certificate issues) or the final certificate.

That last distinction is not pedantry. Both entries commonly appear for the same certificate, and counting them as two issuances overstates activity — a mistake that is easy to make and embarrassing to have corrected.

In practice the retrieval happens through a CT monitor: software that watches logs and makes them searchable, publicly listed by the Certificate Transparency project and including services operated by certificate authorities, security vendors and infrastructure providers. The monitor is a convenience layer. The evidence is the log entry, and the report should preserve the entry and its fingerprint rather than a rendering of a search results page.

Where the identity question is actually answered

The log records that validation succeeded. It does not record how, or by whom. The CA holds that: which validation method was used, against which DNS record or which path on the web server, from which requester account, and from which address. Those validation records are the place the identity question is genuinely answered, and they are obtained through legal process rather than lookup.

There is usually a second custodian. Where certificates were issued automatically — by a hosting control panel, a content delivery network, or an automated certificate management client — the account that requested issuance belongs to the hosting or CDN provider rather than to the person who registered the domain. A certificate obtained automatically by a hosting platform on a customer's behalf tells you the platform was in the path, and the platform's account records tell you who the customer was.

The useful framing for a retaining attorney is that CT identifies the CA and the date, precisely and publicly, and thereby identifies exactly whose records to ask for and for which window. That is often its highest practical value.

What certificate records cannot establish

Certificate Transparency is unusually strong evidence of one narrow fact and no evidence at all of the fact people most want from it. A log entry establishes that a certificate covering a name was issued and logged at a time, which means someone satisfied a CA's control check. It does not name that person, and it was never designed to. The standard is explicit that the framework does not itself prevent misissuance; it makes issuance detectable by interested parties.

Coverage before April 30, 2018 is incomplete. Chrome's requirement applies to certificates issued after that date; before it, logging was largely voluntary, with extended validation certificates covered from January 1, 2015. An empty certificate history for 2012 says nothing whatever about whether a site had a certificate.

Four further gaps belong in the report. Certificates that were never publicly trusted — internal authorities, self-signed certificates — never enter the logs at all. Validation data may be reused for a defined period, so control could have been demonstrated meaningfully earlier than the issuance date. A wildcard certificate covering all first-level subdomains conceals which subdomains actually existed. And a shared or CDN-issued certificate can carry many unrelated domains in one name list, creating an apparent association that reflects only a shared provider. Logs also retire, after which continued availability of historical entries depends on the operator rather than on any guarantee.

Certificate logs cut both ways

Because the framework publicly logs certificates as they are issued, every hostname appearing on a logged certificate becomes public information. That includes internal, staging and unreleased subdomains that were never linked from anywhere and never appeared in a search index.

For an investigator this is a source of leads: a certificate issued in 2019 covering a subdomain nobody has thought about since is a dated, public record that the subdomain existed and that someone controlled it. For a party, it is a disclosure surface. Both sides of a dispute are equally exposed, and a party that assumes its unlinked hosts are private is usually mistaken. It is worth knowing which of those two positions a client is in before the analysis begins.

Authenticating certificate records (US federal rules)

What follows describes United States federal rules only; other jurisdictions and US state courts differ, and application is for counsel.

Rule 901(a) requires evidence sufficient to support a finding that an item is what its proponent claims it is (FRE 901). Certificate records sit unusually well with 901(b)(9), evidence describing a process or system showing that it produces an accurate result, because the process description is published in the standard itself and the record carries its own proof structure — inclusion and consistency proofs derived from the log's Merkle tree. A certificate's SHA-256 fingerprint is a distinctive characteristic of the kind contemplated by 901(b)(4).

Rules 902(13) and 902(14) address certified records generated by an electronic process and certified data copied from a file authenticated by digital identification, each requiring a qualified person's certification and Rule 902(11) notice; CA-produced records are ordinarily considered under Rule 803(6). One caution worth stating in any report: the standard itself warns that auditing mechanisms can be circumvented by a misbehaving log presenting inconsistent views to different clients, which is a reason to corroborate an entry across more than one log or monitor.

What this looks like in an expert report

The exhibit is a table of certificates in date order, each row carrying CA, validity dates, full name list, serial, fingerprint and the logs that recorded it, with the preserved certificate file and its hash produced alongside. The narrative describes what the pattern shows: when certificates for the name first appear, when the issuing CA changes, when a name list expands or contracts, and how those dates sit against the registration and DNS timelines.

Every such statement is framed as demonstrated control rather than ownership, and the pre-2018 coverage limitation is stated in the report rather than conceded later. Where the identity of the requester matters, the report identifies the CA and the window and stops there, because that is where the public record stops.

Frequently Asked Questions

What does a certificate record prove about who owned a domain?

Nothing directly. It proves that a certificate covering the name was issued and logged at a time, which means someone satisfied a certificate authority's domain control check shortly before. Control and registration are different things and frequently sit with different parties — a hosting provider, a developer or an agency may hold operational control of a name registered to someone else. The correct statement in a report is that control was demonstrated to a named authority on a date. Who demonstrated it is answered by the authority's validation records, which require legal process.

How far back do certificate logs go?

Usefully, to around 2015 for extended validation certificates and comprehensively from April 30, 2018, when Chrome began requiring logging for all publicly trusted certificates issued after that date. Before those points logging was voluntary and coverage is partial, so an absence of entries for earlier years is uninformative. Individual logs also have limited lifetimes and move to read-only or retired states, at which point continued availability of their historical entries depends on the operator. Corroborating an entry across more than one log or monitor is worth the small extra effort.

Can a certificate connect two domains to the same operator?

It can raise the question, and on its own it rarely answers it. A single certificate can list many hostnames, but shared and CDN-issued certificates routinely cover unrelated customers of the same provider, so a shared name list may reflect nothing more than a common host. The finding worth making is narrower and stronger: that the same requester account or the same validation method was used, which is established from the certificate authority's records rather than from the log. Treat a shared certificate as a hypothesis with an obvious innocent explanation to exclude first.

What is a precertificate and why does it matter?

A precertificate is a placeholder version submitted to the logs before the final certificate is issued, which is how a certificate can carry proof of logging at the moment it is issued. It matters for evidence because both the precertificate and the final certificate commonly appear as separate entries for what is a single issuance. Counting them separately inflates apparent certificate activity for a domain, which is the sort of arithmetic error that undermines a timeline. Recording the entry type for every row prevents it.

Does a wildcard certificate tell you which subdomains existed?

No, and this is a common over-read. A wildcard certificate covers all first-level subdomains of a name without listing them, so it establishes that the holder demonstrated control of the parent domain and nothing about which specific hosts were actually in use. The inverse over-read also occurs: assuming that because a subdomain does not appear in any certificate it never existed, when it may simply have been covered by a wildcard or never served over TLS at all. Certificates constrain the analysis; they do not enumerate infrastructure.

Can certificate log entries be altered or deleted?

The logs are built as append-only structures whose hash trees make retroactive insertion or alteration of entries detectable, which is the central design property and the reason these records are attractive as evidence. That said, the standard itself warns that auditing can be circumvented by a misbehaving log that presents inconsistent views to different clients, and logs do retire, after which their historical data may cease to be served. Preserving the certificate file and its fingerprint at the time of retrieval, and checking the entry against more than one source, addresses both concerns.
Keep reading

The guides put the pieces in order

An entry covers one kind of work and the record it produces. A guide runs the sequence: when an expert is retained, what is preserved first, what has to be authenticated, and what the report has to carry.

A reference, not an intake page. This site describes what a domain name expert witness does and what the domain record can be made to show. It is not legal advice, nothing on it creates any relationship, and no engagement is taken through this website. The current record of credentials is at hartzer.com.

Top