Certificates Field Reference

October 06, 2026

The Certificates Collection contains parsed X.509 certificates collected both during internet-wide scanning and from publicly available Certificate Transparency Logs. It provides metadata about issuers, subjects, expiration dates, and subject alternative names (SANs).

Property	Description
Document	Each document represents an individual SSL/TLS certificate.
Unique Identifier	One of the fingerprint fields can serve as a unique identifier: - `certificate.fingerprint_md5` - `certificate.fingerprint_sha1` - `certificate.fingerprint_sha256`.
Default Fields	- `certificate.subject_dn` - `certificate.subject.common_name` - `certificate.subject.organization` - `certificate.extensions.subject_alt_name.dns_names` - `certificate.names`

Use field.keyword for exact match searching

Many certificate fields have type TTEXT. To perform exact match searches on these fields, use the .keyword subfield. Refer to the Search Query Language article to learn more about the difference between full-text and exact match searches.

Cert Fields

Parsed metadata extracted from X.509 certificates.

These fields include issuer and subject details, validity period, key usage, signature algorithm, fingerprint hashes, extensions, and compliance-related attributes.

`certificate.chain`

Parsed fields from each certificate in the chain (including intermediates).

Structure is identical to the root certificate object.

Field type: OBJECT

`certificate.extensions`

Parsed X.509 certificate extensions.

These fields represent optional metadata that provides additional information about how the certificate should be used, what constraints apply to it, who issued it, and what services it supports.

Common extensions include Subject Alternative Names (SANs), key usage, certificate policies, OCSP/CRL endpoints, and various extended key usages for web, email, VPN, or document signing.

Field type: OBJECT

Usage in queries:

Code signing certificates issued by Apple:

certificate.extensions.extended_key_usage.code_signing:* certificate.issuer.organization:Apple

Government certificates used for encrypting user data:

certificate.extensions.key_usage.data_encipherment:true

RSA Security signing certificates:

certificate.extensions.key_usage.certificate_sign:true certificate.issuer.organization:"RSA Security"

Certificates used for various Microsoft technologies issued by Microsoft:

certificate.extensions.extended_key_usage.microsoft_\*:true certificate.issuer_dn:Microsoft

Time-stamp service certificates:

certificate.extensions.extended_key_usage.time_stamping:true certificate.subject_dn:"*time stamp*"

`certificate.extensions.authority_info_access`

Locations published by the issuer for downloading issuer certificates and checking revocation through OCSP.

Field type: OBJECT

`certificate.extensions.authority_key_id`

Identifier of the issuer's public key, used to relate a certificate to the key that signed it.

Field type: TTEXT

`certificate.extensions.basic_constraints`

Indicates whether the subject is a certificate authority and, for a CA, the maximum permitted subordinate-CA depth.

Field type: OBJECT

`certificate.extensions.cabf_organization_id`

CA/Browser Forum organization identifier components used to identify a registered legal entity by scheme, jurisdiction, and reference.

Field type: OBJECT

`certificate.extensions.certificate_policies`

Policy OIDs and associated Certification Practice Statement or user-notice information asserted by the issuing CA.

Field type: OBJECT

`certificate.extensions.crl_distribution_points`

Locations from which a Certificate Revocation List (CRL) for this certificate can be retrieved.

Field type: TTEXT

`certificate.extensions.ct_poison`

Indicates the critical Certificate Transparency poison extension used to mark a precertificate that must not be accepted as a final certificate.

Field type: BOOLEAN

`certificate.extensions.extended_key_usage`

Parsed Extended Key Usage (EKU) purposes allowed for the certificate.

Each boolean subfield represents a recognized purpose OID, such as TLS server authentication, client authentication, code signing, email protection, timestamping, OCSP signing, or a vendor-specific Microsoft or Apple purpose. unknown contains EKU values not mapped to a named field.

Field type: OBJECT

`certificate.extensions.issuer_alt_name`

Alternative identities for the certificate issuer, parsed into directory names, DNS names, email addresses, IP addresses, URIs, registered IDs, and other-name OID/value pairs.

Field type: OBJECT

`certificate.extensions.key_usage`

Basic cryptographic operations permitted for the subject public key.

Boolean subfields expose the standard X.509 key-usage bits; value contains their combined numeric representation.

Field type: OBJECT

`certificate.extensions.name_constraints`

Namespace restrictions imposed by a CA certificate on certificates beneath it.

Permitted and excluded subtrees are parsed for directory names, email addresses, IP ranges, general names, and URIs. critical records whether clients must understand and enforce the extension.

Field type: OBJECT

`certificate.extensions.qc_statements`

ETSI Qualified Certificate statements and related compliance metadata.

Parsed values can identify applicable legislation, monetary limits, policy-disclosure locations, retention periods, secure-signature-creation devices, and qualified certificate types. ids preserves the statement OIDs.

Field type: OBJECT

`certificate.extensions.signed_certificate_timestamps`

Embedded Certificate Transparency Signed Certificate Timestamps (SCTs), including the log identity, timestamp, version, signature, and SCT extensions.

Field type: OBJECT

`certificate.extensions.subject_alt_name`

Alternative identities bound to the certificate subject.

Values are parsed into directory names, DNS names, email addresses, IP addresses, URIs, registered IDs, EDI party names, and other-name OID/value pairs. For TLS hostname investigations, dns_names is usually the most useful pivot.

Field type: OBJECT

`certificate.extensions.subject_key_id`

Certificate-provided identifier for the subject public key. Unlike spki_subject_fingerprint, its derivation is selected by the issuer and is not guaranteed to use SHA-256.

Field type: TTEXT

`certificate.extensions.tor_service_descriptors`

Parsed Tor onion-service identity data carried in a certificate, including the onion address and descriptor hash parameters.

Field type: OBJECT

`certificate.fingerprint_md5`

MD5 fingerprint of the complete DER-encoded certificate, stored as lowercase hexadecimal.

Use this as an exact certificate identifier when matching an external MD5 indicator. MD5 is retained for interoperability and correlation; do not rely on it for cryptographic integrity or trust decisions. Prefer fingerprint_sha256 for new indicators.

Field type: TTEXT

Examples: c33979ff8bc19a94820d6804b3681881

Usage in queries:

certificate.fingerprint_md5:c33979ff8bc19a94820d6804b3681881

`certificate.fingerprint_sha1`

SHA-1 fingerprint of the complete DER-encoded certificate, stored as lowercase hexadecimal.

Use this as an exact certificate identifier when a feed or tool supplies SHA-1. SHA-1 is retained for interoperability and correlation; prefer fingerprint_sha256 for new indicators.

Field type: TTEXT

Examples: 310db7af4b2bc9040c8344701aca08d0c69381e3

Usage in queries:

certificate.fingerprint_sha1:310db7af4b2bc9040c8344701aca08d0c69381e3

`certificate.fingerprint_sha256`

SHA-256 fingerprint of the complete DER-encoded certificate, stored as lowercase hexadecimal.

This is the preferred exact certificate identity field. Matching values identify the same certificate bytes across hosts, ports, protocols, or collection sources.

Field type: TTEXT

Examples: 455943cf819425761d1f950263ebf54755d8d684c25535943976f488bc79d23b

Usage in queries:

certificate.fingerprint_sha256:455943cf819425761d1f950263ebf54755d8d684c25535943976f488bc79d23b

`certificate.index`

Position assigned to this certificate within the parsed certificate sequence, when supplied by the collection source.

Field type: #LONG

`certificate.issuer`

Distinguished Name (DN) of the certificate issuer, split into structured fields.

The structure is identical to the subject field. Please note that all subfields are optional.

Field type: OBJECT

Usage in queries:

certificate.issuer.organization:"DigiCert Inc"

certificate.issuer.country:CN

`certificate.issuer_dn`

Raw Distinguished Name (DN) string of the certificate issuer.

Field type: TTEXT

Examples: C=US, O=DigiCert Inc, CN=DigiCert Global G3 TLS ECC SHA384 2020 CA1

Usage in queries:

certificate.issuer_dn:"Let's Encrypt"

`certificate.names`

List of all names found in the certificate CN and SAN fields (certificate.extensions.subject_alt_name).

Field type: TTEXT

Examples: *.example.com, example.com

Usage in queries:

Full-text search for any part of name.
```
certificate.names:example
```

Exact match for name.

certificate.names.keyword:"*.example.com"

`certificate.redacted`

Whether the certificate contains redacted (withheld) fields for privacy.

Field type: BOOLEAN

Examples: true, false

`certificate.serial_number`

Serial number of the certificate as issued by the CA.

Field type: TTEXT

Examples: 14416812407440461216471976375640436634

`certificate.signature.self_signed`

Indicates whether the certificate is self-signed (i.e., issued by the same entity it is assigned to).

Self-signed certificates are usually used in root CAs or testing environments.

Field type: BOOLEAN

Examples: true, false

`certificate.signature.signature_algorithm.name`

Human-readable name of the signature algorithm used to sign the certificate.

Field type: TTEXT

Examples: ECDSA-SHA384, SHA256-RSA

`certificate.signature.signature_algorithm.oid`

Object Identifier (OID) of the signature algorithm, defined by ASN.1 standard.

Field type: TTEXT

Examples: 1.2.840.10045.4.3.3, 1.2.840.113549.1.1.11

`certificate.signature.valid`

Indicates whether the certificate's digital signature is cryptographically valid. This does not imply trust — it only means the signature can be verified.

Field type: BOOLEAN

Examples: true, false

`certificate.signature.value`

The raw base64-encoded signature value from the certificate. This field can be used for low-level cryptographic inspection or fingerprinting.

Field type: TTEXT

Examples: MGUCMQD5poJGU9tv5Vj67hq8/Jobt+9QMmo3wrCWtcPhem1PtAv4PTf4ED8VQSjd0PWLPfsCMGRjeOGy4sBbulawNu1f9DDGnqQ2wriOHX9GO9X/brSzFDAz8Yzu3T5PS4/Yv5jXZQ==

`certificate.signature_algorithm`

Algorithm identifier recorded for the certificate signature, exposed as both a human-readable name and an ASN.1 object identifier (OID).

Field type: OBJECT

`certificate.signature_algorithm.name`

Human-readable certificate signature algorithm name.

Field type: TTEXT

`certificate.signature_algorithm.oid`

ASN.1 object identifier (OID) for the certificate signature algorithm.

Field type: TTEXT

`certificate.spki_subject_fingerprint`

SHA-256 fingerprint of the DER-encoded SubjectPublicKeyInfo (SPKI) block, which contains the subject public key and its algorithm identifier.

Unlike a whole-certificate fingerprint, this value remains the same when a certificate is renewed or reissued with the same public key. It is therefore useful for tracking key reuse across certificates, domains, issuers, and infrastructure. Shared hosting and reused vendor keys can create unrelated matches, so corroborate this pivot with other metadata.

Field type: TTEXT

Examples: 9d77c9a308deb7b5d91be7d8d5e10587bd9381a70913cfad1883b9bdcd825d43

Usage in queries:

Find certificates containing the same subject public key:

certificate.spki_subject_fingerprint:9d77c9a308deb7b5d91be7d8d5e10587bd9381a70913cfad1883b9bdcd825d43

`certificate.src`

Source of the certificate data, URI.

Field type: TTEXT

Examples:

https://195.52.146.178:443/
mysql://49.13.170.178:3306
raw://34.29.76.236:9100

`certificate.subject`

Distinguished Name (DN) of the certificate subject, split into structured fields.

These fields represent the entity the certificate was issued to, such as a company, organization, or individual. Please note that all subfields are optional.

Field type: OBJECT

`certificate.subject.common_name`

Common Name (CN) of the subject, typically a domain name (e.g., example.com) or individual’s name.

Field type: TTEXT

Examples: example.com, *.example.com

`certificate.subject.country`

Country of the subject, represented as a 2-digit code, following the ISO 3166-1 alpha-2 standard.

Field type: TTEXT

Examples: US, DE

`certificate.subject.domain_component`

Components of the domain name represented in LDAP-style DNs (e.g., dc=example).

In practice, many certificates use domain_component for internal identifiers, local domains, or custom naming conventions.

Field type: TTEXT

Examples:

localdomain
XCLOUDCERT

`certificate.subject.email_address`

Email address associated with the subject, if provided in the DN.

Field type: TTEXT

Examples: [email protected]

`certificate.subject.given_name`

Given name (first name) of the subject, when the certificate is issued to a person.

Field type: TTEXT

Examples: John

`certificate.subject.jurisdiction_country`

Country where the subject is legally registered, used in EV certificates.

Represented as a 2-digit code, following the ISO 3166-1 alpha-2 standard

Field type: TTEXT

Examples: US, DE

`certificate.subject.jurisdiction_locality`

City or locality of legal jurisdiction for the subject in EV certificates.

Field type: TTEXT

Examples: Paris, Köln, 北京

`certificate.subject.jurisdiction_province`

State or province of legal jurisdiction for the subject in EV certificates.

Field type: TTEXT

Examples:

New York
Moscow
Zürich

`certificate.subject.locality`

City or locality of the subject’s address.

Field type: TTEXT

Examples: Los Angeles, Paris, Shenzhen

`certificate.subject.organization`

Legal organization or company name the certificate was issued to.

Field type: TTEXT

Examples:

Internet Corporation for Assigned Names and Numbers
ACME Co

Usage in queries:

certificate.subject.organization:"Microsoft Corporation"

`certificate.subject.organization_id`

Unique organization identifier (e.g., business registration number), sometimes used in EV certificates.

Field type: TTEXT

Examples: VATES-P4700000E, DE123456789

`certificate.subject.organizational_unit`

Division or department within the organization, such as IT or Security.

Field type: TTEXT

Examples: IT Department, Security Team

`certificate.subject.postal_code`

Postal code or ZIP code of the subject’s address.

Field type: TTEXT

`certificate.subject.province`

State or province of the subject’s address.

Field type: TTEXT

`certificate.subject.serial_number`

Identifier assigned by the issuing organization to distinguish entities with the same name.

Field type: TTEXT

Examples:

C0806592
0100-01-008840

`certificate.subject.street_address`

Street-level address of the subject.

Field type: TTEXT

`certificate.subject.surname`

Last name (family name) of the subject, when issued to an individual.

Field type: TTEXT

Examples: Doe

`certificate.subject_dn`

Raw Distinguished Name (DN) string of the certificate subject.

Field type: TTEXT

Examples: C=US, ST=California, L=Los Angeles, O=Internet Corporation for Assigned Names and Numbers, CN=*.example.com

Usage in queries:

certificate.subject_dn:netlas.io

`certificate.tbs_fingerprint`

SHA-256 fingerprint of the DER-encoded To-Be-Signed (TBSCertificate) portion of the certificate.

The TBS portion contains the serial number, issuer, subject, validity, public key, and extensions, but excludes the CA's outer signature. Use this fingerprint to correlate certificates whose signed metadata is identical even when their outer signature encoding differs.

Field type: TTEXT

Usage in queries:

certificate.tbs_fingerprint:<sha256-fingerprint>

`certificate.tbs_noct_fingerprint`

SHA-256 fingerprint of the TBSCertificate after Certificate Transparency (CT) data is removed.

This normalizes differences caused by CT-related extensions, making it useful for correlating a precertificate with its final certificate or grouping otherwise equivalent certificate metadata across CT workflows.

Field type: TTEXT

Usage in queries:

certificate.tbs_noct_fingerprint:<sha256-fingerprint>

`certificate.unknown_extensions`

Extensions found in the certificate that do not match any recognized OID or parsing schema.

These fields are preserved as-is and include a critical flag, raw identifier, and raw value. Useful for advanced analysis or future-proofing when dealing with custom or proprietary extensions.

Field type: OBJECT

`certificate.validation_level`

There are three types of certificates depending on the number of validation steps during the certificate issuance procedure:

Domain Validated (DV) certificates provide the lowest level of authentication and poor certificate content.
Organization Validated (OV) certificates provide additional checks during the issuance procedure, these certificates contain more information about the subject, e.g. name of the organization.
Extended Validation (EV) certificates are the most trusted ones and contain maximum information about the subject.

Field type: TTEXT

Examples: DV, OV, EV

Usage in queries:

certificate.validation_level:(OV OR EV)

`certificate.validity`

Certificate validity window and its total duration.

Field type: OBJECT

`certificate.validity.end`

The expiration date of the certificate — the last moment it is considered valid. After this date, clients will reject the certificate as expired.

Field type: DATE

Examples: 2026-12-31T23:59:59Z

Usage in queries:

Certs expires in May, 2023:

certificate.validity.end:[2023-05-01 TO 2023-05-31]

`certificate.validity.length`

Total duration of the certificate’s validity period, measured in seconds. Calculated as end - start.

Field type: #LONG

Examples: 31536000

`certificate.validity.start`

The date from which the certificate becomes valid and can be used. Clients may reject certificates with a future start date.

Field type: DATE

Examples: 2023-01-01T00:00:00Z

Usage in queries:

certificate.validity.start:>2023-01-01

`certificate.version`

The version of the X.509 standard that the certificate follows (usually 3). It indicates the structure and features that the certificate supports.

Field type: #LONG

Examples: 1, 2, 3

Service Fields

Internal metadata about the document lifecycle in the Netlas platform.

`@timestamp`

The timestamp when the cerificate was indexed.

Field type: DATE

Examples:

2023-01-01T12:00:00Z
2023-10-15T08:30:00Z

Usage in queries:

@timestamp:>=now-30d

@timestamp:[now-7d TO now]

@timestamp:[2024-01-01 TO 2024-12-31]