Certificate Transparency (CT) is a system of public, append-only logs that record every SSL/TLS certificate issued by public certificate authorities. Browsers require certificates to be logged, which means anyone – including you – can see every certificate issued for your domain. This guide explains how to use CT to spot mis-issued or unexpected certificates.
Before you start
No setup is needed to search logs. For ongoing monitoring you need a free account with a CT monitoring service or a small script.
How Certificate Transparency works
- When a CA issues a certificate, it submits it (or a pre-certificate) to several CT logs.
- Each log returns a Signed Certificate Timestamp (SCT), which is embedded in the certificate.
- Browsers such as Chrome and Safari reject certificates without valid SCTs from enough logs.
- Monitors read the logs and let domain owners search and get alerts.
Why it matters for you
- Detect mis-issuance – a certificate for your domain issued by a CA you don't use may indicate a compromised account or DNS.
- Find forgotten services – old subdomains and test servers that still request certificates.
- Phishing detection – look-alike domains getting certificates (for example
yourbrand-login.com). - Audit renewals – confirm AutoSSL or Certbot is renewing as expected.
Search CT logs
- Open a CT search site such as crt.sh.
- Search for
example.com, or%.example.comto include all subdomains. - Review the issuer, validity dates and names (SANs) of each certificate.
You will see certificates from your hosting's AutoSSL, Let's Encrypt, CDNs such as Cloudflare, and any other service that serves your domain over HTTPS.
Set up alerts
- Several services (including some CDN and security providers) offer free email alerts when a new certificate for your domain appears.
- Alternatively, query a CT search API daily with a script and compare against a list of expected issuers.
Restrict who can issue: CAA records
CT tells you after the fact; CAA records prevent issuance by CAs you haven't authorised. Combine them:
example.com. IN CAA 0 issue "letsencrypt.org"
example.com. IN CAA 0 iodef "mailto:security@example.com"Include every CA your host and services use (for cPanel AutoSSL, check which CA your server uses) before publishing CAA.
Privacy implications
- Every hostname on a public certificate becomes public, including internal-sounding names like
staging-admin.example.com. - Use a wildcard certificate if you don't want individual subdomain names visible, or keep truly internal services on private CAs.
- Attackers scan CT logs for new hostnames, so secure a service before requesting its certificate.
What to do with an unexpected certificate
- Check whether a service you use (CDN, email provider, website builder) legitimately issued it.
- If not, check your DNS and registrar accounts for unauthorised changes.
- Contact the issuing CA to request revocation and report mis-issuance.
- Add or tighten CAA records.
FAQ: Certificate Transparency
Can I remove my certificates from CT logs?
No. The logs are append-only by design.
Do private CAs log to CT?
No. CT applies to publicly trusted certificates; internal CAs aren't logged.
Does CT slow down certificate issuance?
Barely – logging happens in seconds as part of issuance.