Monitor Certificate Transparency Logs

Watch CT logs for certificates issued for your domains, alert on unknown issuances, and investigate before an attacker can use a mis-issued certificate.

~35 mintlssecuritymonitoring

Task

Detect unexpected certificates for your domains using Certificate Transparency monitoring.

When to use this

An attacker or a misbehaving CA issues a certificate for a domain you own, and you find out only when users are redirected to a phishing site.

Prerequisites

Access to a CT monitoring service or log query
A list of the domains you own

Steps

1. Register your domains with a CT monitoring service.

Expected output: New entries for your names trigger notifications.

2. Send alerts to a channel someone actually watches.

Expected output: Findings are triaged promptly.

3. Validate each finding against your known issuances and CAs.

Expected output: Legitimate renewals do not create noise.

4. For unknown certificates, start revocation and incident handling.

curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq '.[].issuer_name'

Expected output: A mis-issued certificate is contained.

Troubleshooting

Problem

Alert fatigue from wildcard renewals

Solution

Baseline your expected issuers and wildcards so routine renewal notifications are suppressed.

Problem

Unknown cert already in use

Solution

Revoke via the CA and contact the issuer; CT is detection, not prevention.

Limitations

CT monitoring detects but does not prevent mis-issuance, and relies on the logs for completeness.
Some private or internal certificates are not logged, so coverage is limited to publicly trusted issuances.

Context

Detect unexpected certificates for your domains using Certificate Transparency monitoring. An attacker or a misbehaving CA issues a certificate for a domain you own, and you find out only when users are redirected to a phishing site.

Steps

Register your domains with a CT monitoring service. Expected: New entries for your names trigger notifications.
Send alerts to a channel someone actually watches. Expected: Findings are triaged promptly.
Validate each finding against your known issuances and CAs. Expected: Legitimate renewals do not create noise.
For unknown certificates, start revocation and incident handling. Expected: A mis-issued certificate is contained.

curl -s "https://crt.sh/?q=%25.example.com&output=json" \
  | jq -r '.[] | [.issuer_name, .name_value] | @tsv' \
  | sort -u

Verify

New entries for your names trigger notifications.
Findings are triaged promptly.
Legitimate renewals do not create noise.
A mis-issued certificate is contained.

Limits

CT monitoring detects but does not prevent mis-issuance, and relies on the logs for completeness.
Some private or internal certificates are not logged, so coverage is limited to publicly trusted issuances.