Fingerprint Monitor

Monitor certificate fingerprint changes

Domain

Port

Results

About

The Certificate Fingerprint Monitor tracks changes to your SSL certificate fingerprints over time, alerting you when a certificate is replaced or modified. A certificate fingerprint is a unique hash (SHA-256 or SHA-1) of the certificate that acts as a digital fingerprint — any change to the certificate, even reissuance by the same CA, produces a different fingerprint.

This monitoring is critical for detecting unauthorized certificate replacements, man-in-the-middle attacks, and certificate transparency violations. By comparing current fingerprints against stored baselines, you can immediately identify when a certificate has been changed, whether legitimately during renewal or suspiciously due to compromise.

How to Use

1Add domains to monitor for fingerprint changes
2The system captures and stores the current certificate fingerprint as a baseline
3Subsequent checks compare the current fingerprint against the stored baseline
4Receive alerts when any fingerprint change is detected

Use Cases

•Unauthorized Replacement Detection: Detect when someone replaces your certificate with one from a different CA or with a compromised key
•MITM Attack Detection: Identify potential man-in-the-middle attacks where an attacker substitutes a fraudulent certificate
•Renewal Verification: Confirm that certificate renewals maintain the expected fingerprint pattern and detect unexpected changes
•CT Compliance: Verify certificate transparency logs match your expected certificate fingerprints
•Incident Response: Quickly determine if a certificate was tampered with during a security incident investigation

Tips & Best Practices

•Enable fingerprint monitoring for all production domains handling sensitive data
•Set up immediate alerts for fingerprint changes on high-security domains
•Store fingerprint baselines in a secure, tamper-proof location as a backup
•Combine with CT monitoring for comprehensive certificate change detection

Technical Details

●Hash Algorithms: SHA-256 and SHA-1 fingerprint generation following X.509 standards

●Change Detection: Compares current fingerprint against stored baseline on each check

●Alert Triggers: Any fingerprint change generates an alert regardless of CA or reason

●Historical Tracking: Maintains a history of all fingerprint changes with timestamps and reasons

Frequently Asked Questions

Any modification to the certificate changes its fingerprint, including: certificate renewal (even by the same CA), key rotation, domain name changes, CA migration, or unauthorized certificate replacement. The monitor distinguishes between expected changes (scheduled renewals) and unexpected changes that may indicate compromise.

Fingerprints are checked every 24 hours by default, with additional on-demand checks available. Critical domains can be configured for more frequent monitoring. The API also supports real-time fingerprint verification for integration with automated security pipelines.

Yes, the fingerprint monitor works with certificates from any Certificate Authority. It tracks the actual certificate content, not the CA, so it detects changes regardless of which CA issued the certificate. This makes it effective for detecting unauthorized CA migrations.