Archivetls
Certificate Transparency Makes Mis-Issuance Visible
CT does not stop a bad certificate; it guarantees someone can find it.
- Published
- Reading time
- 1 min read
A CA can be compromised or simply make a mistake. Certificate Transparency assumes both and makes every certificate publicly discoverable in append-only logs.
How it works
- CAs submit issued certificates to logs and receive a signed certificate timestamp (SCT).
- The certificate or a precertificate carries SCTs; browsers require them for publicly trusted certs.
- Anyone can monitor logs for certificates for their domains.
Logs are merkle trees, so inclusion can be proven efficiently, and the log's root is signed so tampering is detectable.
What it does not do
- It does not revoke anything.
- It does not prevent issuance — detection is after the fact.
- It depends on monitors actually looking.
Operationally
Run a monitor (or use a service) for your domains. A surprise certificate in a CT log is often the first signal of a mis-issued cert or a compromised account. Expectation of detection changes CA behavior.
Takeaway: CT turns "trust the CA" into "trust but verify, publicly". Monitoring your own domains is the part most teams forget.