Certificate Transparency

Certificate Transparency (CT) is a system of public, append-only logs recording every publicly trusted certificate at the moment it is issued. Browsers require it: a certificate not present in the logs is not trusted.

What it lets you see

An SSL check looks at the certificate a server is currently presenting. CT logs show every certificate that exists for your domain, including ones being served somewhere you do not control, or not served at all.

That is how people discover a subdomain a departed contractor pointed at their own host, a staging environment nobody decommissioned, or a certificate from an issuer their organisation has never used.

Reading them

crt.sh searches the logs for free. Enter a domain and read the hostname list. Most people find something they had forgotten.

Why alerting on every certificate fails

A busy domain reissues constantly — Let's Encrypt renews every sixty days, and every subdomain is its own stream. Alerting per certificate produces several notifications a day, all routine, and the alert gets muted within a week.

What is worth knowing is a change in surface: an issuer or a hostname not seen before. IT Watch baselines the set silently on its first check and alerts only when that set changes.

Related

We wrote about this in A certificate you didn't order.

See also: CAA record, SAN.