Certificate Transparency

Certificate Transparency (CT) is an open framework of public, append-only logs that record TLS certificates when they are issued. It allows domain owners, browsers, and researchers to detect misissued or unauthorized certificates.

How CT Works

Before or during certificate issuance, the CA submits the certificate (or a precertificate) to one or more CT logs. Each log is a cryptographically verifiable, append-only data structure based on Merkle trees. The log operator returns a Signed Certificate Timestamp (SCT), which is a promise that the certificate will be included in the log within a defined time window (the Maximum Merge Delay, typically 24 hours).

The SCT can be delivered to the browser in three ways:

• Embedded in the certificate - the CA obtains SCTs before issuing the final cert and embeds them as an X.509 extension. This is the most common method.
• TLS extension - the server delivers SCTs during the TLS handshake via the signed_certificate_timestamp extension.
• OCSP stapling - the SCTs are included in the stapled OCSP response.

Why CT Matters

Before CT, a compromised or misbehaving CA could issue a certificate for any domain with no public record. CT solves this by making every certificate visible:

• Detect misissued certificates - if a CA issues a cert for your domain that you did not request, it will appear in the public logs.
• Catch CA compromises - unauthorized certificates become discoverable, creating accountability for CAs.
• Enable monitoring - domain owners can watch logs for new certificates matching their domains and respond quickly to unauthorized issuance.

SCTs and Enforcement

Chrome requires certificates to include SCTs from multiple independent CT logs in order to be trusted. The exact number depends on the certificate's validity period. Certificates without valid SCTs will be treated as untrusted and trigger a warning or connection failure.

Apple's Safari and other browsers have adopted similar CT requirements. This means CAs that do not participate in CT effectively cannot issue publicly trusted certificates.

Monitoring Your Domain

To detect unauthorized certificate issuance for your domain:

• Search CT logs directly - tools like crt.sh aggregate data from public CT logs and let you search by domain name.
• Set up alerts - services like Certspotter, Facebook's CT monitoring, and SSLMate will notify you when a new certificate is logged for your domain.
• Review regularly - check for certificates you did not request. Look for unexpected CAs, wildcard certs, or certs covering subdomains you do not control.

If you find an unauthorized certificate, contact the issuing CA to request revocation and investigate how the issuance occurred.

View your domain's CT log history with the TLS tool →