The field ledger / Community submissions
Certainted runs locally on your computer or a compatible network host. Its optional CONNECT proxy sees destination metadata and relays encrypted bytes, but does not decrypt or inspect application contents, store tunneled bytes, or terminate application TLS. For eligible destinations, Certainted makes its own separate TLS connection to retrieve the certificate chain presented to that probe.
This dashboard contains findings that people running Certainted voluntarily choose to share. Visiting it does not upload your local Certainted inventory. Shared reports omit device and workload identity, though hostnames can still reveal sensitive information and the hosting network may see a sender's IP address.
Read every report as a claim. Submissions are unauthenticated. certainted.com checks the report format, but it does not verify that the probe happened or that the original application received this certificate.
Loading community reports…
01 / At a glance
02 / The evidence
A hostname here is a destination the reporter says their independent probe examined. It does not show the application’s own TLS session. A CA watchlist status is assigned by a reporter and is not an authoritative CA verdict.
03 / Read with care
Make a fresh TLS connection. Inspect its presented chain and, if needed, build candidate paths with your own trust store; then compare the listed certificate fingerprint. A different result can reflect rotation, CDN routing, TLS client settings, or network location. It cannot settle what was presented at the reporter’s past vantage.
For a CRL report, obtain the CRL from a trusted source and compare its fingerprint, issuer key, serial, and revocation date. The site receives hashes and metadata, not the CRL itself, and does not fetch it for you.
For a watchlist report, the status and severity are the reporter’s own labels. Look for an authoritative CA, browser, or platform notice before drawing a conclusion.
04 / Boundaries
Certainted probes destinations independently. These reports do not prove which certificate an application received, which root it trusted, whether its connection succeeded, or whether interception occurred. Public submissions are unauthenticated and may be false. No hostnames from private networks, device identifiers, workload names, or application contents belong in this feed.