Certificate Transparency Logs

Also Known As

TL;DR

Explanation

Certificate Transparency (RFC 6962) requires CAs to log every issued certificate to public append-only logs before it can be trusted by browsers. Chrome has required CT since 2018. Benefits: detect rogue certificates (if an attacker gets a certificate for your domain from a compromised CA, CT logs reveal it), monitor your domain for unexpected certificates via crt.sh, and hold CAs accountable. CAA DNS records restrict which CAs can issue for your domain, adding a prevention layer alongside CT's detection.

Common Misconception

Why It Matters

Common Mistakes

• Not monitoring CT logs for your domain — rogue certs go unnoticed
• No CAA DNS record — any CA can issue for your domain without restriction
• Not checking CT logs when deploying new domains
• Assuming HTTPS means no MitM — a rogue cert + HTTPS interception is undetectable without CT monitoring

Code Examples

// No CT monitoring:
// 2024: attacker compromises a CA, gets cert for company.com
// CT log records it immediately — but company has no monitoring
// Attack runs for 12 months before discovered in incident response

# CAA DNS record — restrict which CAs can issue:
# company.com. CAA 0 issue "letsencrypt.org"
# Only Let's Encrypt can issue for company.com

# Monitor CT logs via crt.sh API:
# curl 'https://crt.sh/?q=company.com&output=json' | jq '.[].name_value'
# Or subscribe to Cert Spotter for email alerts on new issuance

References

• ↗ https://certificate.transparency.dev/

Tags

Related Terms