How post-q/pq-map works
pq-map discovers and correlates a domain’s externally visible certificate and cryptographic services. The documented workflow is CT certificate discovery, DNS service discovery, live TLS probing, then correlated text, JSON, or graph output. The graph preserves CT database/HTTP fallback, DNS record discovery, probing and alternate-port scanning, and the cache subsystems. Some orchestration source was not sampled, so the workflow links follow the README; internal call details beyond sampled code are not asserted.
Main entry points: collect.rs Discovery coordinator · cli.rs CLI · mod.rs Endpoint probe coordinator · ctdb.rs CT database lookup
Components 24
Entry and orchestration
- CLI
src/cli.rs - Discovery coordinator
src/collect.rs - Runtime configuration
src/config.rs
Certificate discovery
- CT certificate parsing
src/discover/ct.rs - CT database lookup
src/discover/ctdb.rs - CT HTTP fallback
src/discover/fetch.rs - CT cache
src/discover/cache.rs - Chain cache
src/discover/chain_cache.rs
DNS discovery
- DNS records
src/discover/dns.rs - DNS resolution
src/discover/resolve.rs
Live probing
- Probe cache
src/discover/probe_cache.rs - Alternate-port sweep
src/probe/sweep.rs - Endpoint probe coordinator
src/probe/mod.rs - TLS handshake and parsing
src/probe/tls.rs - OpenSSL fallback
src/probe/tls.rs
State and output
- Correlated domain state
src/model.rs - Text reports
src/render/text.rs - Semantic graph output
src/render/graph.rs - JSON output
src/cli.rs
Other components
- Domain operator
- DNS infrastructure
- Domain services
- CT database
- crt.sh
Connections 26
- Domain operator → CLI: scans domain
- CLI → Runtime configuration: loads settings
- CLI → Discovery coordinator: starts discovery
- Discovery coordinator → CT cache: reads and writes
- Discovery coordinator → CT database lookup: queries CT
- CT database lookup → CT database: queries certificates
- Discovery coordinator → CT HTTP fallback: falls back to HTTP
- CT HTTP fallback → crt.sh: fetches CT records
- Discovery coordinator → CT certificate parsing: normalizes certificates
- Discovery coordinator → Chain cache: reads and writes
- Discovery coordinator → DNS records: discovers records
- DNS records → DNS infrastructure: queries records
- Discovery coordinator → DNS resolution: resolves hosts
- DNS resolution → DNS infrastructure: resolves names
- Discovery coordinator → Probe cache: reads and writes
- Discovery coordinator → Endpoint probe coordinator: probes endpoints
- Discovery coordinator → Alternate-port sweep: scans other ports
- Alternate-port sweep → Endpoint probe coordinator: probes discovered ports
- Endpoint probe coordinator → TLS handshake and parsing: attempts TLS
- Endpoint probe coordinator → OpenSSL fallback: falls back on handshake failure
- TLS handshake and parsing → Domain services: connects to endpoints
- OpenSSL fallback → Domain services: connects to endpoints
- Discovery coordinator → Correlated domain state: assembles state
- CLI → Text reports: renders text
- CLI → Semantic graph output: renders graph
- CLI → JSON output: serializes state