Certificate Transparency
Certificate transparency appends every publicly trusted certificate to an append-only public log, so a misissued certificate is detectable by the domain owner rather than remaining trusted until.
Definition
Certificate transparency is a framework where CAs submit every certificate they issue to append-only public logs that monitors watch; the log inclusion proof is embedded in the TLS handshake, so a client can verify the certificate is publicly logged and a domain owner can detect misissuance.
Context and scope
Applied in the Web PKI, required by Chrome for all publicly trusted certificates, monitored by domain owners and security researchers.
Common misconceptions
- CT guarantees certificates are legitimate — it guarantees they are logged; misissuance detection still requires someone to monitor the logs for your domains
- Embedded SCTs mean the log is trusted — SCTs prove the log accepted the certificate; the log gossip network catches a split log
Anti-patterns
- Relying on CT without monitoring, so a misissued certificate is logged but never noticed until it is used in an attack
- Treating SCT presence as sufficient without verifying the SCT signature against the trusted log key
Related concepts
Authoritative source
What it is
Certificate transparency is a framework where CAs submit every certificate they issue to append-only public logs that monitors watch; the log inclusion proof is embedded in the TLS handshake, so a client can verify the certificate is publicly logged and a domain owner can detect misissuance. Applied in the Web PKI, required by Chrome for all publicly trusted certificates, monitored by domain owners and security researchers. The threat model determines which controls apply: preventive controls block exploits, detective controls surface violations, and corrective controls restore integrity after an incident.
How it works
Effective implementations layer controls so that no single bypass compromises the asset. Verification happens at trust boundaries, not just at the perimeter. Cryptographic primitives are selected for the concrete property needed — unforgeability, indistinguishability, or non-malleability — and never composed ad hoc. Failure modes fail closed: a verification error denies rather than allows.
When to enforce and pitfalls
Enforce wherever an attacker can influence input that crosses a trust boundary. Common pitfalls include treating obfuscation as a control, relying on secrecy of the algorithm rather than the key, and auditing the happy path while ignoring error-handling branches where bypasses often hide. Rate-limit and log every verification attempt so brute-force and oracle attacks become visible.