Certi

Certi is a python based SSL Transparency log monitoring tool that helps you keep tracking your issued certificates.

What are Certificate logs

Certificate logs are append-only ledgers of certificates. Because they're distributed and independent, anyone can query them to see what certificates have been included and when. Because they're append-only, they are verifiable by Monitors. Organisations and individuals with the technical skills and capacity can run a log.

Thanks to CT, domain owners, browsers, academics, and other interested people can analyse and monitor logs. Theyre able to see which CAs have issued which certificates, when, and for which domains.

Features

• Monitor all your domains for certificate.
• Get alerts in many multiple communication channels thanks to apprise
• Manage your domains using REST API (swagger documentation included).

Components and Frameworks used in Certi

• Loguru For logging.
• FastAPI For REST API.
• Apprise For notifications.

Limitations

Certi is using sslmate search API. The free API account has the following limitations:

• 100 single-hostname queries / hour.
• 10 full-domain queries / hour.
• 75 queries / minute.
• 5 queries / second.

A single-hostname query is a query which returns certificates for a single specific hostname. (The include_subdomains parameter is false.)

A full-domain query is a query which returns certificates for all descendant sub-domains of the queried domain. (The include_subdomains parameter is true.)

Supported Notifications

The section identifies all of the services supported by this library. Check out the wiki for more information on the supported modules here.

Popular Notification Services

The table below identifies the services this tool supports and some example service urls you need to use in order to take advantage of it. Click on any of the services listed below to get more details on how you can configure Apprise to access them.

Installation

Certi is a docker based application that can be installed using docker compose:

version: "3.6"
services:
  certi:
    image: techblog/certi
    container_name: certi
    restart: always
    ports:
      - "8081:8081"
    environment:
      - API_KEY=
      - SLEEP_TIME=
      - NOTIFIERS=
      - LOG_LEVEL= 
    volumes:
      - ./data:/opt/certi/db

Environment

• API_KEY - API key for sslmate search API.
• SLEEP_TIME - Time between scans (Default is 7200, which is 2 hours) - To prevent exceeding the search API limits.
• NOTIFIERS - List of Supported Notifications
• LOG_LEVEL - Optional valuse are: DEBUG (default), INFO, ERROR

Volumes

In order to prevent data loss, it's recomended to mount a volume for the application Database. "/opt/certi/db" is the path inside the container where the sqlite db is located. it will be created automatically upon application startup.

Ports

Certi has a managment api for the domains and certificates. by default the port is set to 8081.

Managing the application

Certi has a small REST API endpoint created for easy managment. by default the port is set to to 8081. Swagger documentation can be accessed by adding "/docs" to the end of the url [http://docker:8081/docs].

The api have the following endpoints:

• domains/get (HTTP GET)- Get list of all monitored domains.
• domains/add/{DomainName} (HTTP PUT) - Add domain to monitored domains list.
• domains/delete/{DomainId} (HTTP DELETE) - Delete domain from the monitored domains list.
• /domains/active/{DomainId}/{state} (HTTP POST) - Set domain status to Active/InActive.
• /certificates/get (HTTP GET) - Get list off all certicicates that the Certi found.