Certificate Transparency (CT) log
Certificate Transparency (CT) is a framework, defined in RFC 6962, that requires publicly trusted certificate authorities to publish every TLS certificate they issue into append-only, cryptographically verifiable logs before browsers will treat the certificate as valid. A CT log entry is permanent and publicly searchable, which means a certificate issued for a domain -- whether requested by its owner or mis-issued through a compromised or coerced validation process -- becomes visible to anyone who checks, even well after the fact if nobody was watching at issuance time. CT doesn't prevent mis-issuance or judge whether an issuance was authorized; it only guarantees a record exists, so the security benefit depends on someone actually reviewing a domain's logged certificates, for example through a public log search tool like crt.sh, rather than assuming the absence of an alert means nothing happened.
By AdminKit team, Netbase JSC · Updated