Skip to content

History / TLS Certificate Grab

Revisions

  • docs: udpate wiki

    @samugit83 samugit83 committed Sep 12, 2026
  • docs: complete the TLS Certificate Grab page Was a summary; now a reference an operator can act on. Adds what tlsx actually is and links ProjectDiscovery's repository, a screenshot of the settings section with every control visible, and an explanation of each parameter including what the four deeper probes cost and why each is off by default. Adds the full list of integration points. The grab is one phase but the certificate it captures is read in a dozen places, and only the phase was documented: SAN hostname feedback, vhost/SNI candidates, subdomain-takeover scoring, the six TLS hygiene checks, CDN attribution from the issuer, Service enrichment, the graph, Red Zone shared-infrastructure clustering, the report, and export/import. Adds a "results that look wrong but are not" section, which is the half of the documentation that saves an operator an afternoon: no COVERS_HOST edges in IP mode (scope containment fails closed without an apex), empty findings when the Security Checks master toggle is off, weak ciphers never reported because tlsx's Go TLS client cannot negotiate one, and port 465 named `urd` because that is its IANA registration while the hint carries the observed `smtps`. Also documents how to verify it end to end against testing/guinea_pigs/tls_target.

    @samugit83 samugit83 committed Sep 12, 2026