EnglishRDAP and Certificate Transparency: Two Public Registers About One Domain
Management Summary
Public records offer different views of a domain: RDAP provides registration information, while Certificate Transparency records submitted security certificates. Together they can reveal useful leads about a website’s history and associated names. They are valuable for understanding internet infrastructure, but neither is a complete inventory of current ownership or live services. An old certificate can point to a former service without proving that the service still exists or has been abandoned.
Contents
RDAP and Certificate Transparency answer different questions. RDAP supplies published domain-registration data. CT logs record submitted certificates or precertificates. Together these sources provide useful leads, but neither a complete ownership directory nor an inventory of every running service.
RDAP: structured data with limits
RDAP means Registration Data Access Protocol. Responses contain structured JSON data, such as status values, name servers and available events. Publicly exposed fields depend on the service and access rules. Missing registrant or expiration information does not establish absent registration, inadequate protection or imminent domain availability.
DENIC explicitly operates an RDAP service for .de on a trial basis without promised service levels. A direct request to https://rdap.denic.de/domain/denic.de on 25 October 2026 at 15:25 UTC returned status 200, the domain object denic.de and status active. That response contained no expiration date. An intermediary failure at a service such as rdap.org therefore does not establish that DENIC offers no RDAP service.
A transfer lock provides specific protection
The EPP status clientTransferProhibited, expressed as client transfer prohibited in RDAP, blocks transfer to another registrar while the restriction applies. A server-side transfer restriction is managed by the registry. Neither is a guarantee against every account compromise, DNS change or deletion.
active is not a comprehensive security verdict either. Registrar procedures, authentication and other controls remain relevant. Published expiration information should be compared with the domain’s own contractual and renewal records; automatic renewal or an exact deletion date cannot be established from that field alone.
A CT log, a search service and a running service
CT makes certificate issuance or precertificates publicly auditable. Logs are designed so that new entries can be added while existing entries remain unchanged, and this history can be checked. Browsers apply individual CT policies: the current Chrome policy distinguishes delivery method of signed certificate timestamps (SCTs), certificate lifetime, log state and operator independence. A blanket promise covering every browser and every certificate would conceal those conditions.
crt.sh is a search service over certificate data, not the same thing as all CT logs. Completeness requires evidence of coverage even for small domains. Outages, delays, query limits and local size caps can affect results. Certificates, precertificates and repeated records require an explicit counting method.
Many certificate records for few names can result from renewals but do not establish a particular renewal frequency. A certificate name proves neither a current DNS entry nor a running host. An old maximum expiration date in the retrieved subset likewise does not establish that no newer certificate exists.
What the linked tool actually provides
The Domain RDAP and Certificate Transparency Lookup queries rdap.org and attempts WHOIS when no usable answer is obtained. CT data comes from crt.sh. The implementation checked on 25 October 2026 caps the CT fetch at 3 MiB and returns at most 150 names. Date ordering uses the greatest observed not_after, not the latest log entry or actual service use.
Four isolated tests expose important limits: foreign-only search results can still produce a positive certificate count; a certificate whose validity starts in the future can count as “active” and “new”; even two missing data sources can produce an overall “good” verdict. The display therefore replaces neither certificate validation nor completeness checks. “Forgotten” indicates only a date-based observation in the retrieved subset, not proven service abandonment.
Questions and answers
Does a wildcard certificate prevent disclosure of internal host names?
A certificate for *.example.com can publish the pattern rather than individual host names; additional explicit names in the certificate remain visible. Under normal TLS identity rules the pattern covers one additional level: for example, shop.example.com, but not a.b.example.com. Separate wildcard certificates can use separate keys. Reusing the same certificate and key is what distributes that key material across systems.
Does a private CA guarantee name secrecy?
A private certificate authority outside public trust normally does not require public CT logging. That does not prevent disclosure through DNS, configuration or other channels. Intended clients need appropriate trust configuration. Access protection must not depend solely on an obscure name.
Does an old CT entry prove a subdomain takeover?
No. Current DNS mappings, resource ownership and provider rules require investigation. A dangling CNAME is a DNS alias whose target is no longer assigned to the intended service. It can be dangerous when another party can reclaim that target; some providers prevent domain attachment through ownership verification. Changes to owned DNS records should follow a check with the services responsible for those records. CT supplies investigation candidates, not proof of takeover.
Related articles
