Financial Services|Security Engineer / DevOps

TLS & Certificate Transparency Audit

Monitor TLS protocol versions, OCSP revocation, CT logs, and DNS verification records

Certificate mismanagement causes outages and security incidents. EdgeDNS helps you verify TLS protocol support, check certificate revocation status, monitor Certificate Transparency logs for rogue issuance, and audit DNS TXT records — giving you complete certificate lifecycle visibility.

The Challenge

PCI DSS 4.0 requires TLS 1.2+ enforcement. CAs are deprecating OCSP in favor of CRLs. Unauthorized certificates can be issued without your knowledge. DNS TXT records pile up with verification tokens from dozens of services. Without automated monitoring, certificate-related incidents are discovered only when services break.

The Solution

Use EdgeDNS security APIs to verify TLS version support for compliance, check OCSP revocation status and CA deprecation trends, monitor Certificate Transparency logs for unauthorized certificate issuance, and audit DNS TXT records for domain verification and email authentication.

Endpoints Used

Combine these EdgeDNS endpoints to build this solution.

GET

/v1/domain/tls-versionTry in Playground

TLS Version: Verify TLS 1.2+ support and detect deprecated protocols

GET

/v1/domain/ocspTry in Playground

OCSP Status: Check certificate revocation status and OCSP responder availability

GET

/v1/domain/ct-logsTry in Playground

CT Logs: Search Certificate Transparency logs for issued certificates and rogue issuance

GET

/v1/dns/txtTry in Playground

DNS TXT Records: Query TXT records for verification tokens, SPF, DKIM, and service integrations

GET

/v1/domain/sslTry in Playground

SSL Certificate: Validate certificate chain, expiry, and issuer details

Results You Can Achieve

PCI DSS 4.0 and NIST compliance

Verify TLS 1.2+ enforcement and detect deprecated protocols across all public-facing servers for audit evidence

Detect unauthorized certificate issuance

CT log monitoring reveals rogue certificates issued by unauthorized CAs or for unexpected subdomains

Complete certificate lifecycle visibility

Track certificate rotation patterns, CA changes, OCSP deprecation status, and expiry timelines to prevent outages

Code Example

Audit TLS and certificate transparency

javascript

const domain = 'example.com';
const headers = { 'Authorization': 'Bearer YOUR_API_KEY' };

const [tls, ocsp, ctLogs, ssl, txt] = await Promise.all([
  fetch(`https://api.edgedns.dev/v1/domain/tls-version?domain=${domain}`, { headers }),
  fetch(`https://api.edgedns.dev/v1/domain/ocsp?domain=${domain}`, { headers }),
  fetch(`https://api.edgedns.dev/v1/domain/ct-logs?domain=${domain}`, { headers }),
  fetch(`https://api.edgedns.dev/v1/domain/ssl?domain=${domain}`, { headers }),
  fetch(`https://api.edgedns.dev/v1/dns/txt?domain=${domain}`, { headers }),
].map(p => p.then(r => r.json())));

console.log('TLS Versions:', tls.data.supportedVersions);
console.log('OCSP Deprecated:', ocsp.data.ocspDeprecated);
console.log('CT Log Entries:', ctLogs.data.count);
console.log('SSL Expiry:', ssl.data.certificate?.validTo);
console.log('TXT Records:', txt.data.record_count, '| SPF:', txt.data.has_spf);

if (ctLogs.data.count > 0) {
  const recentCerts = ctLogs.data.certificates.slice(0, 5);
  recentCerts.forEach(c => console.log(` - ${c.issuer} @ ${c.timestamp}`));
}