Chrome requires newly issued publicly trusted certificates to be logged in Certificate Transparency logs, or it refuses to trust them — this error means the presented certificate lacks the required CT proof, typically because the issuing CA failed to log it correctly at issuance time, a rare but not unheard-of CA-side issue.
The fix
This isn't something you can fix through server configuration — the certificate itself needs to be reissued by the CA with proper CT logging completed. If you're seeing this consistently from a specific CA, it's worth reporting to that CA, since it indicates an issue in their issuance pipeline rather than something on your end.
What this error means about a certificate's relationship to CT logs specifically
This error indicates a certificate lacks the required proof of Certificate Transparency log inclusion that Chrome and other CT-enforcing browsers require for trust — covered in more depth in our SSL History category, this is typically a CA-side issuance problem rather than anything the certificate holder configured incorrectly themselves.
How to check whether your certificate is actually logged in CT logs
Searching your domain at a CT log search tool like crt.sh shows every publicly logged certificate for your domain — if your current certificate doesn't appear, that confirms the CT logging gap this error is in particular flagging, worth raising with your CA if you didn't cause the issue yourself.
What to do as a site owner if your CA didn't properly log your certificate
Contacting your CA directly, referencing the specific certificate and its serial number, is the appropriate first step if you suspect your CA failed to properly submit your certificate to required CT logs — this is a CA-side process failure, not something fixable through your own server configuration.
How this error specifically differs from a standard, more common certificate trust error
Unlike a standard trust error indicating a fundamentally untrusted or invalid certificate, a CT-required error can occur on a certificate that's otherwise entirely valid and correctly issued — the certificate itself may be fine, but a specific compliance requirement (logging) wasn't properly satisfied by the CA during issuance.
What the exact steps look like for checking CT log inclusion yourself
Searching your domain immediately at a CT log search tool like crt.sh shows every publicly logged certificate for your domain, letting you outright confirm whether your specific current certificate appears in the expected logs or whether this error is correctly flagging a genuine logging gap.
How to escalate this issue effectively with your CA if it turns out to be their error
When contacting your CA about a suspected CT logging failure, providing the specific certificate's serial number and the exact error message received gives their support team the specific detail needed to investigate quickly, rather than requiring back-and-forth to gather basic information first.
Why smaller or newer CAs occasionally have more CT logging reliability issues
A smaller or newer CA with less mature operational infrastructure may have a higher rate of CT logging issues compared to a large, established CA with years of refined, high-volume issuance infrastructure — worth factoring into CA selection for particularly critical infrastructure.
See RFC 6962, the Certificate Transparency spec in fact implemented in production.
Loading comments…