Certificate Transparency (CT) is a system of public, append-only logs in which certificate authorities record the TLS certificates they issue. Anyone can search the logs, so a certificate issued for your domain without your knowledge can be spotted.
Why it matters
Before CT, a compromised or careless CA could issue a certificate for your domain and you might never find out. Today, browsers such as Chrome expect publicly trusted certificates to carry proof of logging, called a Signed Certificate Timestamp (SCT). The proof is embedded in the certificate, stapled in the handshake, or delivered as a TLS extension.
CT also helps defenders and researchers: every hostname in a public certificate shows up in the logs, which is why CT search is a common way to discover forgotten subdomains.
Example
Search a public CT log aggregator such as crt.sh for your domain:
https://crt.sh/?q=%25.example.comYou will see each certificate with its issuer, issue date and the names it covers. A certificate from a CA you have never used, or for a hostname you did not create, deserves investigation.
Common mistakes
- Assuming CT blocks mis-issuance. It only makes it visible, so someone has to watch the logs.
- Putting secret internal hostnames in public certificates. They become publicly searchable forever.
- Never setting up monitoring. Many CAs and third-party services can alert you on new certificates for your domains.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.