Certificate Transparency (CT)
Public, append-only logs of every issued TLS certificate, so domain owners can spot certificates issued for their domain without permission and browsers can require proof of logging.
What it is
Every publicly-trusted certificate is submitted to CT logs, which return a Signed Certificate Timestamp (SCT). Browsers require SCTs to trust a certificate, and domain owners can monitor logs (e.g. via crt.sh) to detect unexpected issuance. CT complements CAA: CAA prevents, CT detects.
Why it matters
- It makes certificate mis-issuance detectable rather than silent.
- Monitoring CT logs is an early-warning system for domain hijack attempts.
Common mistakes
- Never monitoring CT logs, so a rogue certificate goes unnoticed.
- Assuming CT prevents issuance — it only records it; use CAA to restrict issuers.
How WebInspect checks this
- The Network Inspector can query Certificate Transparency data (crt.sh) and reports certificate findings.