Certificate Transparency Monitor

Monitor CT logs for certificates issued for your domain

About CT Monitoring

Certificate Transparency (CT) monitoring provides continuous visibility into all TLS certificates issued for your domains. By regularly querying CT logs, you can detect unauthorized certificate issuances, track certificate renewals, and maintain an accurate inventory of your TLS certificate landscape. Our CT Monitor helps security teams stay on top of certificate activity and quickly identify potential security incidents.

How to Use

Enter the domain name you want to monitor (e.g., example.com).
Click Search to query Certificate Transparency logs for recent certificates.
Review the list of discovered certificates including issuer and validity details.
Investigate any unexpected or unauthorized certificates immediately.

Use Cases

Rogue Certificate Detection: Identify certificates issued without your authorization, indicating potential security breaches.
Certificate Inventory: Maintain a comprehensive list of all certificates associated with your organization's domains.
Expiry Monitoring: Track certificate renewal patterns and ensure timely reissuance before expiration.
Compliance Verification: Confirm that all certificates for your domains are properly logged in CT logs.

Frequently Asked Questions

For production environments, CT logs should be monitored daily or even in real-time. The sooner you detect an unauthorized certificate, the faster you can respond by revoking it and investigating the breach.

If you find an unexpected certificate, first verify if it was legitimately issued (e.g., by another team). If it's unauthorized, contact the issuing CA immediately to request revocation, and investigate how the certificate was issued without your approval.

Yes, you can use this tool to check any domain. For enterprise-scale monitoring across many domains, consider our Batch Certificate Checker tool or programmatic access to the CT log APIs for automated monitoring workflows.

Silent issuance. Because logs are public and append-only, a certificate issued for your domain becomes visible whether or not you requested it. That means an authority misissuing a certificate cannot do so quietly, and it is why CT is a prerequisite for browser trust. It does not prevent compromise — it makes issuance observable, which is a different and narrower guarantee.

Check whether it is legitimate first: certificates for internal names, staging hosts and forgotten subdomains are common and harmless. What matters is whether it is validly issued and for a name you control. If a certificate exists that you did not request and is not for a name you recognise, contact your authority to have it revoked and investigate how it was issued — that is exactly the scenario CT monitoring exists to catch.

Every certificate from a publicly trusted authority does, which is the condition of being trusted. Internal and private CAs are not required to log, so certificates from a corporate CA will not appear here. Self-signed certificates likewise do not, so a domain that shows nothing may simply be using an internal PKI rather than being misconfigured.

Because each certificate is a separate log entry, so repeated renewals accumulate over time. That is expected behaviour, not a problem — for a domain renewed every 90 days, a few dozen entries a year is normal. What is worth noting is whether the validity windows overlap in a way that suggests two independent renewal systems, which would mean more certificates than expected.

They answer different questions. Revocation says a certificate should no longer be trusted, and it depends on the client checking; transparency says what was issued and cannot be edited afterwards. A revoked certificate remains in the log permanently — that permanence is the point. So CT showing an old certificate is not evidence it is still valid, and revocation is not hidden by it either.

How the Search Works

Certificate Transparency logs are public append-only records of issued certificates. This page queries one of them for a domain and reports the certificates it finds.

1Query the aggregated CT search index for the domain and read the entries it returns — common name, issuer, validity window, serial number and the log that recorded each one.
2Report the total found, with the entries listed. A count well above what your estate should have issued is the interesting signal: it can mean an authority issued certificates for your domain that you did not request, which is the misissuance case CT exists to expose.
3Report query failures as failures, with the status or error, rather than returning an empty list. An empty result and a failed request look identical otherwise, and the difference decides whether you have a clean domain or a broken check.

Results come from an aggregated index rather than an individual log, so coverage and ordering are that service's. For authoritative verification that a specific certificate is in a specific log, query the log directly — which is what monitoring infrastructure should do.

Tips & Best Practices

•Monitor all domains including those without active certificates
•Set up both email and webhook alerts for maximum visibility
•Combine CT monitoring with DNS monitoring for comprehensive security
•Review alert history regularly to identify patterns or recurring issues

Technical Details

Logs: All public CT logs including Google, Cloudflare, DigiCert
Speed: Near real-time detection (typically within 5-15 minutes)
Alerts: Email, webhook, and Slack notifications
History: Complete audit trail of all detected certificates