As part of my forensics, I want to determine if a given certificate has any indicator of which PKI software was used to create it.

So far, I see differences in the following properties for a Certificate Authority:

  • Serial Number (format, length, is ( not) random)
  • Issuer value (may align with internal AD forest name in MSFT)
  • Presence of "Certificate Template Information" (MSFT)
  • CRL Distribution Point contains a server name
  • Subject contains "DC = " (MSFT) versus other properties such as O, C present in Google.com

I'm sure there are comparable differences in end entity certificates, and CRL/CRL Dif certificates.


  • Is there any resource that investigates the differences between the certificate output from various CA's (or makecert.exe for that matter)?

  • Is there any byte level fingerprinting within a certificate? (or is everything exposed via a certificate export?


Not a direct answer, but maybe hints in the right direction

Cert linters

These might be interesting to spot anomalies: There is Peter Bowen's certlint (written in Ruby) and Kurt Roeckx's x509lint. Both of these are integrated into crt.sh. Here are some examples with interesting anomalies: cert for *.gmaptiles.co.kr and example.com

Also there is another certlint: GlobalSign's certlint (written in Go). I haven't tried that.

Pubkey generator identification

Also: There is some research on how to detect the library used to generate RSA pubkeys: From Usenix Sec 2016: The Million-Key Question—Investigating the Origins of RSA Public Keys (Archived here.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.