Home› Blog› Certificate Transparency Logs
← Back to Blog
security

Understanding Certificate Transparency Logs: How CT Works and Why It Matters (2026)

📅 April 6, 2026  •  ⏱️ 6 min read  |  By SSL Checker Tool Team

Certificate Transparency (CT) is a public, auditable logging system for SSL/TLS certificates. Every certificate issued by a CA must be recorded in at least two public CT logs before Chrome (since April 2018) and Safari will trust it. This makes it impossible for a CA to secretly issue a certificate for your domain without it appearing in the public record — which means you can monitor CT logs to detect any certificate issued for your domains, even by CAs you didn't authorize.

🔎

Certificate Search

Search CT logs for all certificates ever issued to your domain.

Try It Free →
2
CT logs return Signed Certificate Timestamps (SCTs)

Each CT log server returns a cryptographic promise (SCT) that the certificate has been logged. The CA embeds these SCTs in the final certificate.

3
Certificate contains SCTs from ≥2 logs

The final certificate includes the SCTs as an X.509 extension. Chrome and Safari verify these SCTs during the TLS handshake — a missing SCT causes the browser to distrust the certificate.

4
Anyone can search CT logs

The logs are public and append-only. Tools like crt.sh let you search all certificates ever issued for any domain. You can subscribe to alerts for new certificates issued for your domains.

What a CT Log Entry Contains

# You can view CT SCTs in any certificate: echo | openssl s_client -connect yourdomain.com:443 2>/dev/null \ | openssl x509 -noout -text | grep -A20 "CT Precertificate SCTs" # Output shows: # Signed Certificate Timestamp: # Version : v1 (0x0) # Log ID : 6F:53:76:AC... ← identifies which CT log # Timestamp : Apr 5 12:22:37.000 2026 GMT # Extensions: none # Signature : ecdsa-with-SHA256 ← cryptographic proof

Searching CT Logs for Your Domain

The most useful tool for searching CT logs is crt.sh, which aggregates certificates from all major CT logs:

# Search crt.sh via API for your domain: curl -s "https://crt.sh/?q=yourdomain.com&output=json" \ | python3 -m json.tool | head -100 # Filter to see only certificates issued in the last 30 days: curl -s "https://crt.sh/?q=yourdomain.com&output=json" \ | python3 -c " import json,sys,datetime data = json.load(sys.stdin) cutoff = datetime.datetime.now() - datetime.timedelta(days=30) for cert in data: issued = datetime.datetime.strptime(cert['not_before'][:10], '%Y-%m-%d') if issued > cutoff: print(cert['not_before'], cert['issuer_name'], cert['common_name']) " # Find wildcards issued for your domain: curl -s "https://crt.sh/?q=%.yourdomain.com&output=json" \ | python3 -m json.tool | grep "common_name"
# Sample crt.sh API output:
[
  {
    "issuer_ca_id": 183267,
    "issuer_name": "C=US, O=Let's Encrypt, CN=R11",
    "common_name": "yourdomain.com",
    "name_value": "yourdomain.com\nwww.yourdomain.com",
    "not_before": "2026-07-14T12:22:37",
    "not_after": "2026-10-12T12:22:36"
  },
  {
    "issuer_name": "C=US, O=DigiCert Inc, CN=DigiCert TLS RSA SHA256 2020 CA1",
    "common_name": "*.yourdomain.com", ← unexpected wildcard — investigate!
    "not_before": "2026-01-05T00:00:00"
  }
]

Using CAA Records to Restrict Who Can Issue Certificates

CAA DNS records let you specify which CAs are authorized to issue certificates for your domain. Any CA that sees a CAA record restricting issuance to other CAs must refuse to issue — and the attempt is logged in CT:

# Add CAA records to DNS (restrict to Let's Encrypt only): yourdomain.com. CAA 0 issue "letsencrypt.org" yourdomain.com. CAA 0 issuewild "letsencrypt.org" yourdomain.com. CAA 0 iodef "mailto:security@yourdomain.com" # Verify your CAA records: dig CAA yourdomain.com +short # 0 issue "letsencrypt.org" # 0 iodef "mailto:security@yourdomain.com" # Combined with CT monitoring: # 1. CAA prevents unauthorized issuance # 2. CT logs record any issuance attempts # 3. You get notified via iodef if a CA tries to issue outside your policy

Setting Up CT Monitoring Alerts

Several free services alert you when a new certificate is issued for your domain:

# Check CT compliance of your certificate: echo | openssl s_client -connect yourdomain.com:443 2>/dev/null \ | openssl x509 -noout -text \ | grep -c "CT Precertificate SCT" # Output should be >= 2 (Chrome requires at least 2 SCTs)

What to Do If You Find an Unauthorized Certificate

  1. Document the CT log entry (certificate serial number, issuer, timestamp)
  2. Contact the CA that issued the certificate and report the misuse
  3. If the cert is fraudulent, request emergency revocation — CAs are required to revoke within 24 hours for key compromise
  4. Add CAA records to restrict future issuance to your authorized CAs only
  5. File a report with the CA's parent organization (DigiCert, Sectigo, etc.) if the CA is unresponsive
CT monitoring is free and takes minutes to set up. If someone steals your domain credentials or social-engineers a CA, a new certificate will appear in CT logs within minutes of issuance. Without monitoring, you might not discover the unauthorized certificate for months.

Verify your certificate has valid CT SCTs

Our SSL checker verifies CT compliance and shows all Signed Certificate Timestamps embedded in your certificate.

SSL Checker CAA Records Guide

Related Articles

DNS CAA Records: Restrict SSL Issuance DV vs OV vs EV SSL Certificates Detect and Fix SSL Vulnerabilities
← Back to Home Return to Blog