Fingerprint Monitor

Monitor certificate fingerprint changes

Domain

Port

Results

About

The Certificate Fingerprint Monitor tracks changes to your SSL certificate fingerprints over time, alerting you when a certificate is replaced or modified. A certificate fingerprint is a unique hash (SHA-256 or SHA-1) of the certificate that acts as a digital fingerprint — any change to the certificate, even reissuance by the same CA, produces a different fingerprint.

This monitoring is critical for detecting unauthorized certificate replacements, man-in-the-middle attacks, and certificate transparency violations. By comparing current fingerprints against stored baselines, you can immediately identify when a certificate has been changed, whether legitimately during renewal or suspiciously due to compromise.

How to Use

1Add domains to monitor for fingerprint changes
2The system captures and stores the current certificate fingerprint as a baseline
3Subsequent checks compare the current fingerprint against the stored baseline
4Receive alerts when any fingerprint change is detected

Use Cases

•Unauthorized Replacement Detection: Detect when someone replaces your certificate with one from a different CA or with a compromised key
•MITM Attack Detection: Identify potential man-in-the-middle attacks where an attacker substitutes a fraudulent certificate
•Renewal Verification: Confirm that certificate renewals maintain the expected fingerprint pattern and detect unexpected changes
•CT Compliance: Verify certificate transparency logs match your expected certificate fingerprints
•Incident Response: Quickly determine if a certificate was tampered with during a security incident investigation

What Is Tracked

Certificate fingerprints change for exactly one legitimate reason — renewal — so a change is either expected or a finding, and the value is in knowing which.

1Record the current fingerprint from the live certificate, which becomes the reference the next check is compared against. SHA-256 is the right form for a security-relevant comparison; the older hashes are for matching existing records.
2Compare against what was recorded previously and treat a change as something to explain rather than as a fault. Renewal is the expected cause and the serial number confirms it — a new serial with the same issuer is a renewal; a changed issuer or subject is worth investigating.
3Keep the history rather than only the latest. The sequence is the useful output: it shows when the certificate changed and lets you correlate that against what you intended to deploy.

This is comparison against a value you hold, not an independent judgement about a certificate. Who issued it and whether the chain is trusted are separate questions the trust pages answer.

Tips & Best Practices

•Enable fingerprint monitoring for all production domains handling sensitive data
•Set up immediate alerts for fingerprint changes on high-security domains
•Store fingerprint baselines in a secure, tamper-proof location as a backup
•Combine with CT monitoring for comprehensive certificate change detection

Technical Details

●Hash Algorithms: SHA-256 and SHA-1 fingerprint generation following X.509 standards

●Change Detection: Compares current fingerprint against stored baseline on each check

●Alert Triggers: Any fingerprint change generates an alert regardless of CA or reason

●Historical Tracking: Maintains a history of all fingerprint changes with timestamps and reasons

Frequently Asked Questions

Any modification to the certificate changes its fingerprint, including: certificate renewal (even by the same CA), key rotation, domain name changes, CA migration, or unauthorized certificate replacement. The monitor distinguishes between expected changes (scheduled renewals) and unexpected changes that may indicate compromise.

Fingerprints are checked every 24 hours by default, with additional on-demand checks available. Critical domains can be configured for more frequent monitoring. The API also supports real-time fingerprint verification for integration with automated security pipelines.

Yes, the fingerprint monitor works with certificates from any Certificate Authority. It tracks the actual certificate content, not the CA, so it detects changes regardless of which CA issued the certificate. This makes it effective for detecting unauthorized CA migrations.

Because it means the certificate changed, and the question is always why. A renewal produces a new fingerprint legitimately, so the alert is not saying something is wrong — it is saying something happened that you should be able to account for. An unexplained change means either a deployment you did not make or something you should not have served, and neither should pass unnoticed.

The serial and issuer answer it. A new serial with the same issuer and the same names is a renewal. A changed issuer, a changed subject, or names appearing that you did not add point to something else entirely — a different authority was involved, or a certificate you did not request was deployed. Comparing those fields turns an ambiguous alarm into a specific answer.

SHA-256 for anything security-relevant. MD5 and SHA-1 remain useful for matching fingerprints recorded in older documentation and configuration, but both are broken for security decisions. Storing a SHA-256 fingerprint costs nothing and stays valid as a reference indefinitely, whereas a matching value from an old system may only exist in a weaker form.

The certificate, if the goal is detecting deployment changes, since every renewal produces a new certificate. The key fingerprint is the better choice when you want to survive reissuance — that is what makes it useful for pinning. For monitoring whether a deployment took effect, the certificate fingerprint is more sensitive and is the more useful signal.

Often enough to notice before the change becomes confusing. Daily suits an actively managed estate and monthly suits a stable one. The cost is low and the value is in having the sequence: when something did change, the recorded history tells you when, and that is frequently the question nobody can answer afterwards.