Chrome requires newly issued publicly trusted certificates to be logged in Certificate Transparency logs, or it refuses to trust them — this error means the presented certificate lacks the required CT proof, typically because the issuing CA failed to log it correctly at issuance time, a rare but not unheard-of CA-side issue.
The fix
This isn't something you can fix through server configuration — the certificate itself needs to be reissued by the CA with proper CT logging completed. If you're seeing this consistently from a specific CA, it's worth reporting directly to that CA, since it indicates an issue in their issuance pipeline rather than something on your end.
What this error means about a certificate's relationship to CT logs specifically
This error indicates a certificate lacks the required proof of Certificate Transparency log inclusion that Chrome and other CT-enforcing browsers require for trust — covered in more depth in our SSL History category, this is typically a CA-side issuance problem rather than anything the certificate holder configured incorrectly themselves.
How to check whether your certificate is actually logged in CT logs
Searching your domain at a CT log search tool like crt.sh shows every publicly logged certificate for your domain — if your current certificate doesn't appear, that confirms the CT logging gap this error is specifically flagging, worth raising with your CA if you didn't cause the issue yourself.
What to do as a site owner if your CA didn't properly log your certificate
Contacting your CA directly, referencing the specific certificate and its serial number, is the appropriate first step if you suspect your CA failed to properly submit your certificate to required CT logs — this is a CA-side process failure, not something fixable through your own server configuration.
How this error specifically differs from a standard, more common certificate trust error
Unlike a standard trust error indicating a fundamentally untrusted or invalid certificate, a CT-required error can occur on a certificate that's otherwise entirely valid and correctly issued — the certificate itself may be fine, but a specific compliance requirement (logging) wasn't properly satisfied by the CA during issuance.
A final note on CA reliability tracking
If you regularly work with multiple CAs, keeping a record of which ones have historically had CT logging reliability issues, if any, helps inform future CA selection decisions for particularly critical infrastructure where this specific class of issuance problem would be especially disruptive.
What the exact steps look like for checking CT log inclusion yourself
Searching your domain directly at a CT log search tool like crt.sh shows every publicly logged certificate for your domain, letting you directly confirm whether your specific current certificate appears in the expected logs or whether this error is correctly flagging a genuine logging gap.
How to escalate this issue effectively with your CA if it turns out to be their error
When contacting your CA about a suspected CT logging failure, providing the specific certificate's serial number and the exact error message received gives their support team the specific detail needed to investigate quickly, rather than requiring back-and-forth to gather basic information first.
A quick closing checklist
A quick closing checklist covers checking CT log inclusion directly at a tool like crt.sh, confirming this is a CA-side issuance issue rather than anything in your own configuration, and escalating to your CA with the specific certificate serial number if logging genuinely wasn't completed.
Why smaller or newer CAs occasionally have more CT logging reliability issues
A smaller or newer CA with less mature operational infrastructure may have a higher rate of CT logging issues compared to a large, established CA with years of refined, high-volume issuance infrastructure — worth factoring into CA selection for particularly critical infrastructure.