Certificate Transparency log monitoring

Certificate Transparency is a public, append-only record of the certificates that certificate authorities issue. Publicly trusted certificates must be logged to these CT logs — the Chrome and Apple root programs require it — so that mis-issued certificates cannot stay hidden. The logs are large: well over a million certificates are recorded every day.

Monitoring CT logs turns that record into a security alert. Every time a certificate is issued for one of your domains, it appears in the logs, whether or not you requested it. A certificate you did not authorise showing up for your domain is worth knowing about the same day, because it can be the first sign of a compromised DNS record, a mis-issuance, or an attacker preparing to impersonate your site.

This is a check an expiry monitor does not do. Expiry watching looks at the certificate you already serve; CT monitoring watches the wider record for new certificates naming your domains, so the two answer different questions. Together they cover both ends of a certificate’s life: the one you serve is still valid, and no unexpected one has been issued behind your back. For a domain that matters, that early warning is the difference between catching an impersonation attempt within a day and finding out when a customer reports it, which can be days or weeks later.