Live Certs is a set of Maltego transforms that connect directly to a TLS server and read the X.509 certificate it presents. No third-party data provider is involved: the transforms open a TLS handshake with the host and port you give them and return the certificate chain the server sends. A second group of transforms then breaks a certificate entity down into its parts: the domains it covers, the country and organization of its subject, the issuer, and the dates it is valid from and until.
Live Certs Transforms
To Certificate Chain
Fetches the certificate chain from the given TLS server. The certificates are returned in the order the server sends them, up to the transform limit. If the server cannot be reached the transform returns a warning (Exception: Could not connect to server), and if the server sends no certificates it returns No results found.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
TCP port | int | 443 | true | false | false |
A port outside the range 0-65535 gives a warning and no results.
Transform Meta Info
Information | Value |
Display Name | To Certificate Chain |
Author | Maltego |
Data Source | The TLS server (direct TLS handshake) |
Input Entities | maltego.Domain, maltego.DNSName |
Output Entities | maltego.X509Certificate |
Short Description | Fetch the certificate chain from the given TLS server |
Output details
Output Entity | Description |
maltego.X509Certificate | One entity per certificate in the chain, with the properties Subject (common name), Issuer (common name), Subject DN, Issuer DN, Country, Organization, Serial, Valid From, Valid To, Subject Alternative Names, Authority Key Identifier and Subject Key Identifier. X.509 version 1 certificates have no key identifiers, so those two properties are not set. |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
ssl.DomainToCerts | maltego.Domain | Fetch the certificate chain from the given TLS server |
ssl.DNSNameToCerts | maltego.DNSName | Fetch the certificate chain from the given TLS server |
To Certificate
Fetches the certificate from the given TLS server. Only the first certificate the server sends (the server's own certificate) is returned, whatever the transform limit is. Errors and empty results are reported as for *To Certificate Chain*.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
TCP port | int | 443 | true | false | false |
Transform Meta Info
Information | Value |
Display Name | To Certificate |
Author | Maltego |
Data Source | The TLS server (direct TLS handshake) |
Input Entities | maltego.Domain, maltego.DNSName |
Output Entities | maltego.X509Certificate |
Short Description | Fetch the certificate from the given TLS server |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
ssl.DomainToCert | maltego.Domain | Fetch the certificate from the given TLS server |
ssl.DNSNameToCert | maltego.DNSName | Fetch the certificate from the given TLS server |
To Domains
Retrieves all the domains that are identified by the certificate. The names are read from the certificate's Subject Alternative Names, and one DNS name entity is returned for each, up to the transform limit. A certificate without Subject Alternative Names gives no results.
Transform Meta Info
Information | Value |
Display Name | To Domains |
Author | Maltego |
Data Source | The input certificate (no lookup is made) |
Input Entities | maltego.X509Certificate |
Output Entities | maltego.DNSName |
Short Description | Retrieves all the domains that are identified by the certificate |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
ssl.certToDomains | maltego.X509Certificate | The DNS names listed in the certificate's Subject Alternative Names. |
To Country
Retrieves the country of a certificate. The country code in the certificate subject is returned as a location with the English country name, the country and the country code. If the code is not a known country, it is used as the name.
Transform Meta Info
Information | Value |
Display Name | To Country |
Author | Maltego |
Data Source | The input certificate (no lookup is made) |
Input Entities | maltego.X509Certificate |
Output Entities | maltego.Country |
Short Description | Retrieves the country of a certificate |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
ssl.certToCountry | maltego.X509Certificate | The country of the certificate subject. |
To Valid From
Derives the date from which the certificate is valid. The date is returned as a date/time entity, with the month and year (for example Jan 2025) in its Month property and the link labelled "Valid from". If the date cannot be read, the certificate's original text is returned unchanged.
Transform Meta Info
Information | Value |
Display Name | To Valid From |
Author | Maltego |
Data Source | The input certificate (no lookup is made) |
Input Entities | maltego.X509Certificate |
Output Entities | maltego.DateTime |
Short Description | Derives the date from which the certificate is valid |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
ssl.certToValidFrom | maltego.X509Certificate | The start of the certificate's validity period. |
To Valid Until
Derives the date until which the certificate is valid. The date is returned as a date/time entity, with the month and year in its Month property and the link labelled "Valid until".
Transform Meta Info
Information | Value |
Display Name | To Valid Until |
Author | Maltego |
Data Source | The input certificate (no lookup is made) |
Input Entities | maltego.X509Certificate |
Output Entities | maltego.DateTime |
Short Description | Derives the date until which the certificate is valid |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
ssl.certToValidTo | maltego.X509Certificate | The end of the certificate's validity period. |
To Organization
Retrieves the organisation of the certificate. The organization in the certificate subject is returned as an organization entity.
Transform Meta Info
Information | Value |
Display Name | To Organization |
Author | Maltego |
Data Source | The input certificate (no lookup is made) |
Input Entities | maltego.X509Certificate |
Output Entities | maltego.Organization |
Short Description | Retrieves the organisation of the certificate |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
ssl.certToOrganization | maltego.X509Certificate | The organization of the certificate subject. |
To Issuer
Retrieves the issuer of a certificate. The issuer's common name is returned as a phrase entity.
Transform Meta Info
Information | Value |
Display Name | To Issuer |
Author | Maltego |
Data Source | The input certificate (no lookup is made) |
Input Entities | maltego.X509Certificate |
Output Entities | maltego.Phrase |
Short Description | Retrieves the issuer of a certificate |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
ssl.certToIssuer | maltego.X509Certificate | The issuer of the certificate. |
Notes
- Only the certificate fetch contacts a server. To Certificate Chain and To Certificate connect to the TLS server; the other six transforms only read properties of the certificate entity you give them. If the property they need is missing, they return no results.
- Chain order: certificates are returned in the order the server sent them, so the server's own certificate normally comes first.
- Result limit: To Certificate always returns at most one certificate.