What is Certificate Transparency?

Certificate Transparency is the public audit system for the web PKI: every certificate a public CA issues is recorded in append-only, cryptographically verifiable logs that anyone can search. It exists because CAs can make mistakes or be compromised, and before CT there was no way for a domain owner to even find out that a certificate for their domain had been issued to someone else.

The mechanism has three parts. CAs submit each certificate (or its precertificate) to independent logs. The logs return a signed certificate timestamp, an SCT, promising inclusion. Browsers then require SCTs before trusting a certificate — Chrome has enforced this for all certificates issued since April 2018, and Safari enforces it too, with both requiring proof of inclusion in multiple independent logs. A publicly trusted certificate that was never logged simply does not work in mainstream browsers.

The practical consequence is that issuance is observable. You can query the logs — crt.sh is the best-known interface — for every certificate ever issued for your domains. Doing so regularly turns CT into a detection tool: an unexpected certificate for your domain means a misconfigured internal team, a CA validation failure, or an attacker who passed validation, and all three are things you want to know about within hours, not at renewal time.

CT cuts the other way as well. Every hostname in every certificate you request becomes public and searchable the moment it is issued, including staging and internal names. Attackers enumerate new subdomains from CT feeds in near real time, so a hostname in a certificate should be treated as an announcement. If a name must stay unlisted, put it behind a wildcard entry or issue it from a private CA that never touches the public logs.