To make the certificate system more trustworthy, the industry introduced Certificate Transparency (CT). It makes certificate issuance more visible and helps organizations find certificates that may have been issued incorrectly or unexpectedly.
In this guide, we'll explain what Certificate Transparency is, how it works, why it is important for website security, and how organizations use CT logs to keep track of certificates issued for their domains.
What Does Certificate Transparency Mean
Certificate Transparency is a security system that makes the issuance of TLS certificates public and easier to monitor. When a Certificate Authority (CA) issues a certificate for a website, information about that certificate is added to public Certificate Transparency logs. These logs create a record of certificates issued for different domains. Website owners, security teams, browser vendors, and security researchers can check these records to find certificates they do not recognize or expect.
This is important because Certificate Authorities can sometimes issue certificates by mistake or, in rare cases, issue one to someone who should not have received it. Without CT, the domain owner may not know that the certificate exists.
With Certificate Transparency, organizations can monitor their domains and investigate unusual certificates. For example, if a certificate suddenly appears for your domain from an unfamiliar CA, your security team can check whether it was issued for a legitimate reason.
What Are Certificate Transparency Logs
Certificate Transparency logs are public records of TLS certificates issued by Certificate Authorities. They are an important part of Certificate Transparency because they let people see which certificates have been issued for a website or domain.
When a CA issues a certificate, it sends information about that certificate to one or more CT logs. The certificate is then added to the log and becomes part of a public record. Website owners and security teams can check these logs to see what certificates have been issued for their domains.
How CT Logs Keep Certificate Records Safe
CT logs are designed to be append-only. This means new certificate records can be added to the log, but old records cannot simply be changed or deleted. This helps make sure that someone cannot secretly remove or change a certificate after it has been added.
CT logs also use something called Merkle trees to help keep the records safe. A Merkle tree is a way of organizing information using special codes called cryptographic hashes. These hashes work like digital fingerprints. If someone changes a certificate record, its fingerprint changes too, making the change easier to spot.
CT logs are also publicly auditable, which means different people and organizations can check them. Security researchers, browser companies, website owners, and security services can search the logs for certificates issued for specific domains. This is especially helpful for large companies that manage hundreds or even thousands of domains and subdomains. They can keep an eye on their certificates and quickly investigate anything they do not recognize.
How Does Certificate Transparency Work?
Certificate Transparency may sound complicated, but the basic process is easier to understand when you break it into steps. Here is how the process works:
Step 1: A Website Requests a TLS Certificate
The process starts when a website owner needs a TLS certificate for their domain. For example, imagine a company that owns example.com. To use HTTPS, the company needs a certificate that tells browsers that its website is allowed to use a secure TLS connection.
The website owner sends a certificate request to a Certificate Authority. The request includes information such as the domain name that the certificate should cover and other details needed to create the certificate. Also, at this point, the CA has not issued the certificate yet. It first needs to make sure that the request is valid.
Step 2: The CA Checks the Domain
Before issuing the certificate, the Certificate Authority needs to confirm that the person or organization requesting it has control over the domain. This step is important because a CA should not give someone a certificate for a domain they do not control. For example, an attacker should not be able to request a certificate for example.com simply by asking a CA for one.
The CA uses different methods to check domain control. One common method is asking the requester to add a specific piece of information to the domain's DNS records. Another method may require the requester to place a specific file on the website or respond to a verification request sent to an approved email address.
Once the CA is satisfied that the requester controls the domain and meets its requirements, it can continue with the certificate issuance process.
Step 3: The CA Creates and Signs the Certificate
After the request has passed validation, the CA creates the TLS certificate. This certificate contains important information about the website, such as the domain names it is valid for, the Certificate Authority that issued it, and the period during which it can be used.
The CA then digitally signs the certificate using its private key. This signature is important because browsers can use it to check that the certificate really came from the CA that claims to have issued it and that the certificate has not been changed. At this stage, the website has a valid TLS certificate that can be used to establish HTTPS connections.
Step 4: The Certificate is Sent to CT Logs
The next part is where Certificate Transparency comes into the process.
The CA submits the certificate to one or more Certificate Transparency logs. The logs record the certificate and add it to their public record.
The important thing to understand is that the CT log is not issuing the certificate. The CA is still responsible for issuing and signing it. The CT log simply records the certificate so that its issuance can be publicly checked later. CAs generally submit certificates to multiple CT logs rather than relying on only one. This provides greater visibility and helps support the trust and reliability of the CT system.
Step 5: The CT Log Gives the Certificate an SCT
After receiving the certificate, the CT log provides a Signed Certificate Timestamp (SCT) which is basically a cryptographic promise from the CT log that says, in effect, “I have accepted this certificate for inclusion in my log.” The SCT contains information about the certificate and the CT log, along with a digital signature from the log. This signature allows other systems to verify that the SCT really came from that CT log.
It is important to understand that an SCT does not mean that the certificate is safe or that the CA made the right decision when issuing it. Instead, it provides evidence that the certificate was submitted to a CT log. You can think of it like getting a receipt after submitting a document. The receipt proves that the document was submitted, but it does not mean that the document itself was correct.
Step 6: The SCT is Provided With the Certificate
The SCT then needs to be made available to the systems that need to check it and there are several ways this can happen. For example, the SCT can be included directly in the TLS certificate or provided by the server during the TLS connection.
When a user visits the website, the browser can receive the certificate and the related CT information as part of the connection process. Although, the exact way CT information is handled can vary depending on the certificate, browser, and TLS setup, but the main idea remains the same: the browser needs a way to verify that the certificate has been properly logged.
Step 7: Browsers Can Check the CT Information
Finally, the browser can use the SCT and other Certificate Transparency information when checking the website's certificate.
The browser can verify the SCT's digital signature and check that the certificate was submitted to a trusted CT log. Depending on the browser and certificate requirements, the browser may expect a certificate to have enough valid CT evidence before accepting it as trusted. This gives browsers another way to make sure certificates are being issued and logged as expected.
For website owners, this process also creates an opportunity to monitor their domains. If a certificate appears in a CT log that the organization did not expect, the security team can investigate where it came from and whether it is legitimate.
Overall, the Certificate Transparency process connects Certificate Authorities, CT logs, browsers, and website owners. The CA verifies and issues the certificate, the CT log records it and provides an SCT, and browsers and security teams can use this information to improve visibility into certificate issuance.
This does not stop a CA from making a mistake. Instead, it creates a system where certificate issuance can be seen, checked, and investigated rather than happening without public visibility.
Why is Certificate Transparency Important
Here is how Certificate Transparency monitoring gives organizations a way to keep an eye on certificate activity across their domains and take action when something unexpected appears:
Find Certificates You Did Not Request
One of the biggest reasons to monitor CT logs is to find certificates that your organization did not request. For example, suppose your company owns example.com and normally uses one Certificate Authority to issue its certificates. If a new certificate for example.com suddenly appears from a different CA, your security team may want to know why. There could be a simple explanation, such as a developer using a different CA or a new service provider requesting the certificate. However, if nobody in the organization recognizes it, the certificate should be investigated to make sure it is legitimate.
Without CT monitoring, the organization may not know that the certificate was issued in the first place. By monitoring CT logs, security teams can spot these changes and check where they came from. This gives them a chance to confirm whether the certificate is part of normal business activity or something that needs further attention.
Detect Misissued Certificates
Certificate Authorities are trusted to issue certificates only after completing the required checks. However, mistakes can still happen. A CA could accidentally issue a certificate for the wrong domain, approve a request that should not have been approved, or make an error during the validation process. When this happens, CT monitoring can help organizations spot these misissued certificates and find out what happened.
Once a suspicious certificate is found, the organization can contact the CA and ask questions about how the certificate was issued. If the certificate should not have been issued, the organization can also take steps to have it revoked. Therefore, monitoring is important because the sooner a misissued certificate is discovered, the sooner the organization can investigate the problem and take action.
Spot Possible Security Problems
An unexpected certificate does not automatically mean that a company has been attacked. However, it can sometimes be an early warning sign that deserves attention, especially when the organization cannot explain why the certificate was issued. For example, an attacker who gains control of a domain or finds a way around a CA's validation process may try to obtain a certificate for that domain. If the certificate is successfully issued, it will appear in CT logs.
By monitoring these logs, security teams can find unusual certificates and investigate them as part of a wider security check. They can compare the certificate with their internal records, check who requested it, and look for other signs of suspicious activity. As a result, CT monitoring gives organizations another source of information that can help them identify possible security threats at an earlier stage.
Keep Track of Subdomains
Large organizations often have many subdomains, and it can be difficult to know exactly what is being used across the entire organization. A company may have subdomains for its main website, customer portal, development systems, marketing campaigns, applications, and third-party services. As new systems are created and old ones are removed, some subdomains can easily be forgotten.
CT monitoring can reveal certificates issued for these subdomains, which can help security teams discover systems or services they may not have known about. For example, a forgotten subdomain may still have an active certificate even though the original project has been abandoned. Finding it gives the security team a chance to check whether the system is still needed, whether it is properly secured, and whether it should remain accessible.
Improve Certificate Management
Monitoring CT logs can also make certificate management easier. Organizations can use CT monitoring to keep track of when new certificates are issued for their domains, which Certificate Authorities are being used, and whether any unexpected certificate activity appears. This can help security teams maintain a clearer picture of their certificate inventory, especially when certificates are being created by different teams or services.
This is particularly useful for large companies where different teams may create websites, applications, and other online services independently. Instead of relying only on internal records, security teams can use CT logs as an additional source of information about certificates connected to their domains. This can help them find certificates that may have been missed in their own records and keep their overall certificate management more organized.
Respond to Problems Faster
The value of CT monitoring is not just finding certificates; it is also about finding them early. If an unexpected certificate is discovered soon after it is issued, the security team has more time to understand what happened and take action. They can confirm whether the certificate is legitimate, contact the CA if needed, revoke a certificate, or investigate other signs of compromise. Early detection can make it easier to deal with a problem before it causes greater damage.
Without monitoring, an organization may discover an unexpected certificate much later, possibly after it has already been used in an attack. For this reason, CT monitoring works best as part of a wider security process. It gives organizations better visibility into certificate activity, helps them notice changes sooner, and allows them to respond quickly when something does not look right.
How Do Organizations Monitor Certificate Transparency?
Organizations monitor CT to keep track of certificate activity across their domains and investigate anything unusual. These are the usual steps to go about:
Start With Your Domains
The first step is to decide which domains and subdomains need to be monitored. This can include the main website, important subdomains, customer portals, APIs, and other services that are available online.
This becomes more important for large organizations because different teams may use different cloud platforms, hosting providers, and Certificate Authorities. A security team may not always know when another team creates a new service or requests a certificate. Starting with a clear list of domains and subdomains helps the organization understand what certificate activity it should normally expect.
Watch for New Certificates
Once the domains are identified, organizations can monitor CT logs for new certificates connected to them. When a new certificate appears, the monitoring system can collect details such as the domains covered by the certificate, the Certificate Authority that issued it, and when it was issued.
The team can then compare this information with its existing records. A new certificate is not automatically a security problem because there may be a valid reason for it. For example, the company may have moved to a new hosting provider or started using a different CA. Monitoring simply makes sure the new certificate does not go unnoticed.
Check Unexpected Certificates
If monitoring finds a certificate that the organization does not recognize, the security team can investigate it. They can first check whether someone in the company requested it or whether it came from a third-party provider or cloud service.
If the certificate still cannot be explained, the team can inspect it more closely. An SSL certificate checker can help with this because it shows important details about the certificate currently being used by a domain. For example, NsLookup.io's SSL Checker can show the certificate issuer, validity period, certificate chain, covered hostnames, TLS version, and other certificate details. It can also check multiple domains at once.
Investigate the Certificate Details
Checking the certificate details can help answer an important question: Is the certificate actually being used, or was it only issued?
This matters because a certificate appearing in a CT log does not always mean that the website is currently using it. A security team can compare the certificate found through CT monitoring with the certificate that the domain's server is currently providing.
For example, suppose CT monitoring finds an unexpected certificate for api.example.com. The team can use an SSL checker to check that hostname and compare the live certificate with the one found in the CT log. They can look at details such as the issuer, expiration dates, covered domain names, certificate chain, and TLS settings. This can help them understand whether the certificate is active and whether it matches the organization's expected setup.
Automate Alerts and Follow-Up
For organizations with many domains, checking certificate activity by hand is not practical. Automated monitoring can check certificates regularly and alert the right people when something needs attention.
NsLookup.io provides SSL monitoring that can monitor certificates across multiple domains and send alerts when certificate-related problems are found. These alerts can be sent through email, Slack, webhooks, or PagerDuty, allowing security teams to connect certificate monitoring with the tools they already use.
It is also helpful to separate different types of alerts. An unexpected certificate may need a security investigation, while a certificate that is close to expiring may only need to be renewed. Keeping these alerts separate helps teams focus on the problems that need immediate attention.
Keep Monitoring Over Time
Certificate monitoring should not be a one-time check. New certificates can be issued at any time, and organizations can also change their domains, services, hosting providers, or Certificate Authorities.
For this reason, CT monitoring should be part of an ongoing security process. Regular monitoring helps teams stay aware of new certificate activity, while tools such as SSL checkers can help them investigate individual certificates when something unusual appears. Together, these checks help organizations understand which certificates are expected, which ones need attention, and whether the certificates being used by their domains are configured correctly.
Stay on Top of Certificate Activity
Certificate Transparency gives organizations better visibility into the certificates issued for their domains, but that visibility is most useful when it is part of regular security monitoring. By keeping an eye on certificate and domain activity, security teams can spot unexpected changes and investigate them before they become bigger problems.
If you want to take the next step, NSLookup.io can help you monitor your DNS records and get notified when something changes. This gives your team another useful layer of visibility into your domains and helps you stay aware of changes across your DNS infrastructure. Start free DNS monitoring to keep an eye on your domains without having to check them manually.