..
    generated, remove this comment to keep this file

``certlog.certificates``
========================

.. code-block:: console

    $ target-query <path/to/target> -f certlog.certificates


.. list-table:: Details
    :widths: 20 80

    * - Module
      - ``dissect.target.plugins.os.windows.certlog.CertLogPlugin``
    * - Output
      - ``records``

**Module documentation**

Return all available data stored in CertLog databases.

Certificate Authority databases are databases related to the Active Directory Certificate Services (AD CS) feature.

References:
    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-csra/5f06c74c-1a29-4fdf-b8dd-ae3300d1b90d
    - https://assets.crowdstrike.com/is/content/crowdstrikeinc/investigating-active-directory-certificate-abusepdf
    - https://learn.microsoft.com/en-gb/troubleshoot/windows-server/certificates-and-public-key-infrastructure-pki/move-certificate-server-database-log-files

**Function documentation**

Return the contents of ``Certificates`` table from all Certificate Authority databases.

Gives insight into issued certificates for a Certificate authority (public key, validity date).