Direct answer
A certificate can list names associated with a TLS service, but a listed name is only a discovery lead. Confirm current DNS, business ownership and authorization with the asset owner before testing or claiming the service is active.
Record what was observed
Capture the certificate's relevant name, issuer and validity period, the source and observation time. A certificate can cover several names and can remain visible after a service changes. Do not infer an active application solely from a name in the certificate.
Reference: RFC 5280: Internet X.509 Public Key Infrastructure Certificate Profile.
Corroborate current ownership
Compare candidate names with the organization's asset inventory and ask the responsible owner whether they are current and in scope. A third-party service can use a name on behalf of the organization, and an expired certificate can be historical evidence rather than current exposure.
Reference: NIST SP 800-115: Technical Security Testing.
Separate TLS from service risk
A certificate being valid or a TLS connection being encrypted does not establish that a site's content, access controls or business request is trustworthy. Conversely, a certificate error needs investigation but does not automatically establish malicious intent.
- Record whether the certificate is current or historical.
- Do not test a newly discovered host without authorization.
- Mark unclear ownership as unresolved.
Use a coverage ledger
If an owner adds the host to scope, record the approved methods and status separately from discovery. If ownership remains unclear, keep the lead untested and identify the person who can resolve it. Avoid expanding the assessment solely on public certificate evidence.
Assessment limits
Certificate observations can be stale, incomplete or shared across services. They do not establish current service reachability, ownership, security or permission to test.
Frequently asked questions
Does a certificate name prove a website is active?
No. The certificate may be historical or cover a name that is not currently served. Verify current state with the owner.
Does HTTPS prove a site's request is legitimate?
No. Encryption does not establish the site's identity in a business sense or the truth of its request.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.