Certificate Transparency Logs: Anyone Can See Every Cert Issued for Your Domain
Certificate Transparency is a public, auditable logging system that records essentially every publicly trusted SSL/TLS certificate ever issued, for any domain, by any participating certificate authority — a system most site owners have never heard of, despite the fact that it means a complete, searchable history of every certificate ever issued for their domain has been sitting in public view the entire time.
Why Certificate Transparency Was Created
CT logs were developed specifically in response to several serious historical incidents where certificate authorities mis-issued certificates — sometimes through compromise, sometimes through simple error — for domains without the actual domain owner's knowledge or authorization. Before CT logs existed, there was no reliable, systematic way for a domain owner to discover that a certificate had been fraudulently or mistakenly issued for their own domain by some certificate authority somewhere in the world, since certificate issuance events weren't centrally recorded or monitored in any accessible way.
How the System Actually Works
CT logs are append-only, cryptographically verifiable public ledgers, maintained by multiple independent operators (including major browser vendors and other organizations), that record every certificate submitted to them. Since 2018, major browsers have effectively made CT log submission mandatory in practice — Chrome, for instance, requires a certificate to have valid proof of CT log submission (called Signed Certificate Timestamps) before it will trust that certificate at all, meaning any certificate authority wanting its certificates to actually work in mainstream browsers has no real choice but to log every certificate it issues.
What This Means Practically for a Domain Owner
Because logging is effectively universal, anyone can query these logs to see a complete history of every certificate ever issued for a specific domain, using freely available tools like crt.sh, which provides a simple search interface over the aggregated log data. This includes certificates issued by certificate authorities the actual site owner never contacted or authorized, which is precisely the scenario the system was built to make visible and detectable.
Using CT Logs as a Security Monitoring Tool
Security-conscious organizations increasingly monitor CT logs proactively for their own domains, specifically watching for the appearance of any unexpected certificate — one issued by a certificate authority they don't use, for a subdomain they don't recognize, or at a time nobody on their team requested one. Several commercial and free monitoring services exist specifically to automate this watching process, sending an alert the moment a new certificate appears in the logs for a monitored domain, functioning as an early-warning system for both certificate authority mis-issuance and, in more serious cases, a genuine account compromise being used to fraudulently request a legitimate-looking certificate.
The Privacy Tradeoff Worth Understanding
A less-discussed side effect of universal CT logging is that it makes every subdomain that's ever had a certificate issued for it — including internal, staging, or otherwise unpublicized subdomains a business might have preferred to keep low-profile — publicly discoverable through a simple log search, since the certificate's subject name is recorded in the log regardless of whether the site itself is publicly linked from anywhere. Security researchers, and occasionally attackers performing reconnaissance, routinely use CT logs specifically for this purpose: discovering an organization's less obvious subdomains by searching the logs rather than needing to guess or brute-force hostnames.
How Let's Encrypt Discovered This Gap
CT logs became especially useful for spotting the class of mis-issuance concern discussed earlier once high-volume automated issuers like Let's Encrypt entered the market, since automated issuance at massive scale means any systemic flaw in a validation method gets exercised far more times, far faster, than the old manual process ever did — making CT logs an essential complementary safeguard specifically because automation removed the human review step that once, however imperfectly, served as an informal secondary check on unusual issuance patterns.
How to Mitigate the Subdomain Exposure Risk
For organizations concerned about this specific exposure, a few mitigations are available: using a wildcard certificate (discussed elsewhere on this blog) means the logged certificate name reveals only the wildcard pattern itself rather than each specific subdomain individually, since individual subdomains aren't separately logged when covered under a wildcard's single certificate. Beyond that, treating any genuinely sensitive internal system as requiring more than "an obscure, unpublished hostname" for its actual security is the more fundamentally sound practice, since CT log exposure is just one of several ways a hostname can become discoverable regardless.
The Takeaway
Certificate Transparency logs exist as a genuine, valuable security safeguard against certificate mis-issuance, but they also mean every certificate ever issued for a domain — including for subdomains never intended to be publicly known — sits in a permanently searchable public record. Monitoring these logs proactively for your own domains turns this transparency into a useful early-warning system rather than purely a source of unexpected exposure.
Tags: Certificate Transparency, CT logs, SSL monitoring