Certificate Transparency
A certificate security mechanism proposed by Google in 2013 and standardized as RFC 6962, requiring CAs to record all issued certificates in publicly auditable log servers. This enables domain owners and the security community to monitor and detect unauthorized certificate issuance.
Core Facts
Timeline (last 90 days)
Feasible mitigation measures include mandatory auditing of Certificate Transparency (CT) logs, regular external audits of CA organizations, and shortening certificate validity periods to reduce the impact window of a single point of failure.
Certificate Transparency (CT) logs are public SSL/TLS certificate logging systems; researchers can discover newly launched subdomains by querying CT logs, even if those subdomains do not appear in DNS records.
Certificate Transparency (CT) logs require CAs to publish every certificate they issue, so if attackers issue certificates, in theory a public record will be left behind.
The author built CT Lookup, which outputs certificate transparency data as JSON and includes a watchlist that can catch certificates issued for your domain that you did not apply for.
Certificate Transparency (CT) is a public auditing mechanism that requires certificate authorities to record every TLS certificate they issue in public, append-only, verifiable logs.
All publicly trusted CAs must submit certificate information to at least one CT log when issuing a certificate, so when a new website applies for an SSL certificate, its domain information appears in the public log.
All Facts (6)
All publicly trusted CAs must submit certificate information to at least one CT log when issuing a certificate, so when a new website applies for an SSL certificate, its domain information appears in the public log.
65%UnverifiedFeasible mitigation measures include mandatory auditing of Certificate Transparency (CT) logs, regular external audits of CA organizations, and shortening certificate validity periods to reduce the impact window of a single point of failure.
50%UnverifiedCertificate Transparency (CT) logs are public SSL/TLS certificate logging systems; researchers can discover newly launched subdomains by querying CT logs, even if those subdomains do not appear in DNS records.
50%UnverifiedCertificate Transparency (CT) logs require CAs to publish every certificate they issue, so if attackers issue certificates, in theory a public record will be left behind.
50%UnverifiedCertificate Transparency (CT) is a public auditing mechanism that requires certificate authorities to record every TLS certificate they issue in public, append-only, verifiable logs.
50%UnverifiedThe author built CT Lookup, which outputs certificate transparency data as JSON and includes a watchlist that can catch certificates issued for your domain that you did not apply for.
50%