Certificate Transparency Triage in n8n: Sheets, Slack & OpenAI

Stay ahead of new subdomains with Certificate Transparency triage in n8n—Sheets, Slack & OpenAI

This n8n workflow automatically monitors Certificate Transparency (via crt.name) for newly observed subdomains, records them in Google Sheets, probes selected hosts over HTTPS, and sends a digest to Slack and Gmail. Optionally, it can refine triage using an OpenAI chat model—without letting AI override your rules-based severity.

What this workflow does

• Runs daily (or manually): Loads configuration such as your apex domains, Google Sheet details, probe limits, and alert thresholds.
• Builds a baseline in Google Sheets: Ensures the sheet tab has expected header columns, then reads existing rows to track already-known hostnames.
• Finds new certificates: Queries crt.name for each apex domain, keeps only newly observed hostnames, and filters out matches to configured ignore substrings.
• Prioritizes what to probe: Classifies each new hostname using an exposure policy and expected prefix list, then selects up to the configured probe cap of higher-priority names.
• Probes via unauthenticated HTTPS: Performs a single unauthenticated HTTPS request per selected host, extracts evidence (status, server header, title), detects common product indicators and possible subdomain takeover responses, and assigns a rules-based verdict.
• Optional OpenAI refinement: If enabled, batches findings into one OpenAI chat prompt and applies AI verdicts/explanations while ensuring it can’t downgrade rule-based severity.
• Updates records & alerts: Writes all new hostnames (probed and unprobed) to Google Sheets, then sends grouped alerts to Slack and an HTML email via Gmail for results at or above the alert threshold.

Use cases

• Detect unexpected issuance of certificates for new subdomains on your SaaS or infrastructure domains.
• Reduce noise by probing only higher-priority hosts and logging everything to Google Sheets.
• Get near-real-time investigation leads in Slack with an accompanying Gmail digest for security or platform teams.

Technical details

• n8n workflow nodes/blocks: if, set, code, gmail, merge, slack
• Core integrations/services: crt.name for Certificate Transparency discovery, Google Sheets for persistence, OpenAI for optional triage refinement
• Alerting: grouped Slack messages and HTML email via Gmail