Skip to content

SSL Behavior

SSL certificate lifecycle: issuance, length, issuer reputation, certificate-rotation patterns. Each fires with named evidence and a 3-question analyst Q&A trail.

About

What SSL Behavior captures

SSL certificate lifecycle: issuance, length, issuer reputation, certificate-rotation patterns. Tier-1 SOC analysts use them to cut triage time on suspicious http crawling history behavior; CTI teams pivot from them to the broader campaign graph.

Verdict scenarios

How SSL Behavior shapes the call

Three real-world situations where SSL Behavior evidence dominates the decision. Verdict and explanation are how VerdictIQ would frame the outcome to an analyst, not raw signal slugs.

High riskVERDICT · BLOCK
The situation

A site serving a self-signed or short-validity certificate issued in the last 24 hours.

VerdictIQ explains

Decline. Throwaway certificates are the standard launch shape for phishing. Real businesses provision proper TLS before going live.

Medium riskVERDICT · REVIEW
The situation

A site rotating its certificate every few weeks across multiple low-trust issuers.

VerdictIQ explains

Send to analyst review. The rotation pattern is unusual and may indicate evasion behavior. Confirm before granting trust.

Low riskVERDICT · ALLOW
The situation

A site on a long-validity OV or EV certificate from a top-tier issuer, held for years.

VerdictIQ explains

Allow. The certificate posture matches a mature, organization-validated property. No SSL reason to delay.

Sibling subgroups

Other subgroups in HTTP Crawling History

4 more subgroups in this group, each bundling signals that share a different mechanism. Tap one to inspect its signal names.

See SSL Behavior signals fire on your data

Free tier: 100 IOCs/day, LLM layer included.