Certificate Transparency.

An ecosystem of append-only public logs of TLS certificates, defined by RFC 6962 and 9162, that lets anyone audit which certificates exist for any domain. It belongs to the Defense & Operations category of cybersecurity.

An ecosystem of append-only public logs of TLS certificates, defined by RFC 6962 and 9162, that lets anyone audit which certificates exist for any domain.

Certificate Transparency (CT) requires public CAs to submit every issued TLS certificate to one or more append-only Merkle-tree logs, returning a Signed Certificate Timestamp that the browser can verify. The logs are openly searchable through services such as crt.sh, Censys, Cert Spotter, and Google's CT log viewer. Defenders use CT to discover their own shadow IT subdomains, detect look-alike phishing certificates, monitor for unauthorized issuance, and pivot during investigations. Threat hunters watch CT feeds for new certificates that match brand keywords or attacker patterns, often within minutes of issuance, which is faster than passive DNS or WHOIS.

Defences for Certificate Transparency typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: CT logs, CT.