X.509 Certificates

FAN/1 X.509 fingerprints are passive fingerprints extracted from TLS Certificate handshake messages in packet captures. They complement TLS ClientHello and ServerHello fingerprints by describing the certificate generation profile visible on the wire.

x509|server|idx=<chain_index>|ver=<x509_version>|serial_len=<serial_byte_length>|sig=<outer_signature_algorithm_oid>|tbs_sig=<tbs_signature_algorithm_oid>|issuer=<issuer_name_oid_values>|subject=<subject_name_oid_values>|valid_days=<validity_window_days>|spki_alg=<subject_public_key_algorithm_oid>|spki_param=<algorithm_parameter_oid_or_der>|pk_bits=<subject_public_key_bit_string_size>|san=<subject_alt_names>|ku=<key_usage_bits>|eku=<extended_key_usage_oids>|bc=<basic_constraints>|ski=<subject_key_identifier_shape>|aki=<authority_key_identifier_shape>|pol=<certificate_policy_oids>|aia=<authority_info_access_shape>|crldp=<crl_distribution_point_shape>|nc=<name_constraints_shape>|ext=<critical_flag_and_extension_oid_order>

Fields

Field	Meaning
x509	Protocol namespace.
server	Certificate sender role currently emitted by passive TLS parsing.
idx	Zero-based certificate index in the observed TLS certificate list.
ver	X.509 version number, usually 3.
serial_len	Length of the encoded serial number after leading zero stripping.
sig	Outer certificate signature algorithm OID.
tbs_sig	TBSCertificate signature algorithm OID.
issuer	Issuer distinguished-name attributes as oid=value pairs in DER order.
subject	Subject distinguished-name attributes as oid=value pairs in DER order.
valid_days	Number of days between notBefore and notAfter when both times parse.
spki_alg	SubjectPublicKeyInfo algorithm OID, such as RSA or EC public key.
spki_param	SubjectPublicKeyInfo parameter OID or DER hex value when present.
pk_bits	Size of the SubjectPublicKey BIT STRING payload in bits.
san	Decoded DNS, IP, email, URI, and OID Subject Alternative Names.
ku	Raw Key Usage extension bytes in hexadecimal.
eku	Extended Key Usage OIDs joined with -.
bc	Basic Constraints summary, including CA flag and optional path length.
ski	Short SHA-256-derived token over Subject Key Identifier extension content.
aki	Short SHA-256-derived token over Authority Key Identifier extension content.
pol	Certificate policy OIDs joined with -.
aia	Short SHA-256-derived token over Authority Information Access content.
crldp	Short SHA-256-derived token over CRL Distribution Points content.
nc	Short SHA-256-derived token over Name Constraints content.
ext	Extension layout as critical_flag:oid entries in certificate order.

Rationale

Raw certificate hashes identify an individual certificate exactly, but they are poor similarity features for regenerated certificates. The FAN/1 X.509 feature string keeps generation-oriented parameters: OIDs, distinguished-name layout, public-key algorithm parameters, SAN shape, validity duration, and extension profile. These fields can help cluster certificates issued by the same CA profile, management appliance, malware kit, interception product, or automated certificate generator even when serial numbers, key material, and dates change.

Passive Extraction Notes

fanfp.py parses TLS Certificate handshake bodies from TCP payloads. It supports classic TLS certificate lists and TLS 1.3 certificate entries with per-certificate extensions. Each certificate in the list is emitted as a separate JSON object with protocol set to x509; the frame and flow fields point back to the packet where the certificate was observed.