Every other TLS scanner only sees the current cert. Cipherwake mines Certificate Transparency logs to track the actual private key behind every cert a domain has ever issued. These are the domains where 'cert rotation' didn't actually rotate the underlying key — meaning years of harvested traffic across multiple cert renewals all decrypt with one key compromise. This is the unique finding most ASM tools miss.
| # | Domain | Score | Grade | Key reuse (yrs) | Freshness |
|---|---|---|---|---|---|
| 1 | treasury.gov | 5.9 | C | 1.6 (2 rotations) | verified 5h ago |
| 2 | cedars-sinai.org | 5.9 | C | 1.6 (2 rotations) | verified 5h ago |
| 3 | monday.com | 5.9 | C | 1.6 (2 rotations) | verified 1h ago |
| 4 | irs.gov | 4.9 | C | 1.6 (2 rotations) | verified 5h ago |
| 5 | uchicagomedicine.org | 4.9 | C | 1.5 (3 rotations) | verified 5h ago |
| 6 | erstegroup.com | 4.7 | C | 1.5 (2 rotations) | verified 5h ago |
| 7 | gm.com | 5.9 | C | 1.2 (8 rotations) | verified 21h ago |
| 8 | subaru.com | 4.9 | C | 1.1 (2 rotations) | verified 34h ago |
| 9 | gitlab.com | 5.8 | C | 1.0 (2 rotations) | verified 5h ago |
| 10 | npr.org | 3.4 | B | 0.8 (5 rotations) | verified 19h ago |
| 11 | epirus.com | 6.0 | D | 0.7 (4 rotations) | verified 5h ago |
| 12 | nissan.com | 3.4 | B | 0.6 (4 rotations) | verified 29h ago |
| 13 | houstonmethodist.org | 5.2 | C | 0.6 (3 rotations) | verified 5h ago |
| 14 | keybank.com | 4.6 | C | 0.5 (3 rotations) | verified 5h ago |
| 15 | baesystems.com | 4.6 | C | 0.4 (10 rotations) | verified 5h ago |
| 16 | santander.com | 5.0 | C | 0.4 (18 rotations) | verified 5h ago |
Run the same scan we use for this ranking. See your specific findings, get the migration steps, and track the domain so you know when your score improves.