Certificates

Certificates in the app is /security/certificates.

Certificate visibility is a small but high-signal part of security hygiene: expiring certs cause outages and indicate operational maturity gaps.

Use this when…

• you want to avoid certificate-related incidents
• you’re preparing evidence for availability/security controls
• a customer asks about encryption in transit and operational monitoring

Recommended workflow

• Monitor certificate expiry and ownership.
• Treat “expired/expiring soon” as an operational task with a clear owner.
• Keep notes that connect cert ownership to the relevant asset/service.

How the page works

Add a domain manually or let an integration contribute monitored domains. Manually added domains can be removed in Noru; integration-managed domains must be changed at their source. Noru scans Certificate Transparency logs daily and groups certificate records under the monitored domain.

The directory can show current coverage or all CT records, search domains/issuers/serials/SANs, sort by expiry or domain, and filter by lifecycle, data source, and issuer. Current coverage focuses on certificates relevant to the present domain view; historical CT records remain useful for discovery and investigation.

What to investigate

• expired or soon-to-expire certificates still serving production
• unexpected issuers or subject alternative names
• newly observed subdomains or certificates with no accountable owner
• duplicate/reissued certificates and whether old keys were retired
• certificates visible in CT that no longer belong to the organization

CT logs show publicly logged issuance, not necessarily what is currently deployed, privately issued, trusted, or controlled by your organization. Confirm observations with DNS, hosting, certificate deployment, and asset ownership before escalating or closing them.

For compliance, certificate history can support encryption-in-transit, monitoring, inventory, and change management controls. It does not prove protocol configuration, private-key protection, or complete domain ownership by itself.