Certificate Transparency Explained
What certificate transparency is and how public logs work
Certificate transparency is a public record of TLS certificates. Certificate authorities must publish each publicly trusted certificate to append-only logs, and major browsers require proof of this before they trust the certificate.
Each log is a server that accepts certificates and stores them in a tamper-evident structure. Anyone can read the logs. When a certificate authority issues a certificate, it submits the certificate to one or more logs. The log returns a signed certificate timestamp, usually called an SCT, which is delivered with the certificate as proof that it was logged.
Because the logs are append-only, entries cannot be quietly removed or changed. The whole ecosystem can therefore see what has been issued, for which names and by which authority.
Why certificate transparency was introduced
Certificate authorities are trusted to issue certificates only to the real owner of a domain. When a CA makes a mistake, or is compromised, it can issue a certificate for a domain it should not, and the victim may never know. Such a certificate could be used to impersonate a login page for a bank without anyone noticing quickly.
Logging changes this. A mis-issued certificate leaves a permanent public trace, so it can be found after the fact. The browser requirement also gives CAs a strong reason to log everything, because a certificate without proof of logging will not be trusted.
Transparency does not stop a bad certificate from being issued. It makes misuse discoverable, which lets the affected CA, browser vendors and domain owners respond. A CA that repeatedly misissues can be distrusted, and revocation can invalidate the bad certificate.
Spotting a certificate nobody ordered
Imagine a company that owns example-shop.com. Its staff ordered one certificate through their hosting provider last year. A monitoring service that watches public logs for the company's domain alerts the security team to a new certificate for a name they do not use, issued by a CA they have never worked with.
The team checks whether the request came from their own accounts. If it did not, they contact the CA and request revocation before anyone can use the certificate, then investigate how the request was made.
Frequently asked questions
Is certificate transparency the same as revocation?
No. Revocation declares a specific certificate invalid before its expiry date. Certificate transparency is a public record of certificates that were issued. A certificate appears in the logs whether it is still valid, expired or revoked, so the logs are for visibility rather than enforcement.
How can a website owner see certificates issued for their domain?
Domain owners can search public logs for their domain name using a log search tool or a monitoring service. Results list the certificates issued for the name and the authority that issued each one. Checking these results regularly, or setting up alerts, helps catch unexpected issuance early. The chain of trust then shows how each certificate links back to a trusted root.