pq-map 0.2.0

Domain service and cryptography discovery from Certificate Transparency and DNS
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58

# pq-map

discovery and mapping of externally visible cryptographic identities and services using Certificate Transparency and DNS

CT estate (crt.sh certwatch DB → HTTP fallback → cache) → DNS discovery (SRV/SVCB/HTTPS, A/AAAA) → live TLS probe (rustls PQ-first, openssl fallback) → correlated text / JSON / graph output.

![pq-map graph](graph.png)

## Usage

```
pq-map nbp.pl                # combined text view (default)
pq-map nbp.pl --summary      # certificate estate summary
pq-map nbp.pl --hosts        # hostnames of valid certificates
pq-map nbp.pl --certs        # CT certificate records
pq-map nbp.pl --json         # full state as JSON
pq-map nbp.pl --graph        # semantic graph JSON (see visualization below)
pq-map nbp.pl --refresh      # force fresh CT + full re-probe
pq-map nbp.pl --no-probe     # CT/DNS only, no TLS handshakes
```

Caches in `~/.cache/pq-map/`: CT 7 days, probes 24 hours. DNS resolves every run and invalidates cached probes; failed probes are cached too. `--refresh` bypasses both.

## Visualization

```
./pq-graph.sh                 # serves ./graph.json on :8000, opens browser
./pq-graph.sh graph.json 9000
```

3d-force-graph viewer

## ENV vars

- `CT_DB_HOST=crt.sh`
- `CT_DB_PORT=5432`
- `CT_DB_USER=guest`
- `CT_DB_DB=certwatch`
- `CT_DB_CONNECT_TIMEOUT=30`
- `CT_DB_QUERY_TIMEOUT=120`
- `CT_CACHE_TTL=604800`
- `PROBE_CACHE_TTL=86400`
- `PROBE_TIMEOUT=8`
- `PROBE_CONCURRENCY=32`
- `DNS_TIMEOUT=5`
- `DNS_ATTEMPTS=2`
- `DNS_CONCURRENCY=32`

## Build

```
cargo build --release    # rust 1.85+, libssl-dev
cargo test
```

## License

EUPL-1.2