Certificate Transparency Log Monitor
How public CT logs record the SSL/TLS certificates CAs issue, and how to use them to spot certificates for your domains that you did not request.
What is Certificate Transparency?
Certificate Transparency (CT) is an open framework that requires all publicly-trusted Certificate Authorities to log every SSL/TLS certificate they issue to publicly-auditable, append-only logs.
This means that if a CA mis-issues a certificate for your domain — whether through a compromise, social engineering, or error — it is in public view, where you can find it, rather than hidden until someone uses it.
Google Chrome, Firefox, and Safari all require valid CT proofs (Signed Certificate Timestamps) before trusting a certificate.
Browsers only trust certificates that have been logged, so one issued for your domain without your request is in the public logs for anyone to find.
CT logs are cryptographically verifiable and publicly accessible — anyone can audit them.
Since 2018, Chrome requires all new certificates to appear in CT logs or they won't be trusted.
On paid plans, CertNotify reads the logs for your monitored domains once a day and alerts you when a new certificate comes from an issuer outside a list of commonly used CAs.
What CT Log Entries Look Like
(illustrative example)
| Domain | Issuer | Type | Valid For |
|---|---|---|---|
*.example.com | Let's Encrypt | Wildcard | 90 days |
api.example.net | DigiCert | DV | 199 days |
*.example.org | Sectigo | Wildcard | 199 days |
login.example.com | ZeroSSL | DV | 90 days |
secure.example.net | GlobalSign | OV | 199 days |
checkout.example.org | Let's Encrypt | DV | 90 days |
api.example.com | DigiCert | EV | 199 days |
*.internal.example.net | ZeroSSL | Wildcard | 90 days |
auth.example.org | Sectigo | DV | 90 days |
staging.example.com | Let's Encrypt | DV | 90 days |
Example data for illustration — not a live feed. For your own domains, CertNotify's paid plans check CT once a day and alert on certificates from issuers outside a list of common CAs.
Monitor CT Logs for Your Domains
On paid plans, CertNotify reads public CT data from crt.sh for each monitored domain once a day. When a new certificate comes from an issuer outside a list of commonly used CAs, you get an alert. A certificate from one of those common CAs does not alert, even if you did not request it; the free CT log search lists every certificate logged for a domain.