What Is Certificate Transparency and Why Does It Matter?

The Problem CT Solves

Before Certificate Transparency, a Certificate Authority could issue a certificate for any domain without the domain owner's knowledge. In 2011, DigiNotar was compromised and issued fraudulent certificates for Google.com that were used in man-in-the-middle attacks against Iranian internet users. The attack was only discovered weeks later.

Certificate Transparency makes it impossible to issue a certificate that goes undetected.

How CT Works

Every publicly-trusted certificate must be submitted to at least two Certificate Transparency logs before browsers accept it. CT logs are:

• Append-only: certificates can be added but never removed or altered
• Publicly auditable: anyone can query and verify the log
• Cryptographically verifiable: the log uses a Merkle tree structure that makes tampering detectable

When a CA issues a certificate, it submits the certificate to CT logs and receives Signed Certificate Timestamps (SCTs) in return. The SCTs are embedded in the certificate or delivered via TLS extension. Browsers verify that valid SCTs are present.

What You Can Do With CT Logs

CT logs are public. This means anyone can search for all certificates issued for a domain:

https://crt.sh/?q=%.example.com

This is useful for:

• Discovering subdomains (security research, asset inventory)
• Detecting unauthorised certificate issuance
• Monitoring for certificate expiry
• Verifying that your CA is submitting to logs correctly

Certificate Authority Authorization (CAA)

CAA is a complementary DNS record that explicitly lists which CAs are authorised to issue certificates for your domain:

example.com    CAA    0 issue "letsencrypt.org"
example.com    CAA    0 issue "digicert.com"

CAs are required to check CAA records before issuing. If your domain has a CAA record, only listed CAs can issue certificates.

Check your domain's certificates in CT logs with our SSL Certificate Checker, which queries crt.sh directly.