Certificate Transparency Monitoring: Catch Unauthorized Issuance

How CT logs work in 30 seconds

Browsers require publicly trusted certificates to be logged to multiple public, append-only CT logs before they are trusted. Every issuance — legitimate or not — leaves a permanent, searchable record: domain names, issuer, validity window, and fingerprints. Nothing stays secret; that is the point.

One-off check: search crt.sh now

Enter %yourdomain.com at crt.sh (the % is a wildcard). Review every issuer: your CA, your CDN, your SaaS vendors — and flag anything you don't recognize. Do this today; most teams have never looked and are surprised by forgotten vendor issuance.

Continuous monitoring: baseline + alert

• Fingerprint baseline per site: record every known-good certificate; any new fingerprint is guilty until reviewed.
• Alert with context: issuer, SAN list, validity, and log source — enough to judge legitimacy without a second tool.
• Harden issuance: tight CAA records (see which DNS records to watch) so only your CAs can issue at all.

Pair it with the basics

CT monitoring is the second half of certificate coverage. The first half — daily expiry and chain monitoring of known certificates — prevents outages; CT prevents silent compromise. Certack runs both from the same dashboard, starting free.