Certificate Transparency (CT) is a system of public, append-only logs that record every certificate issued by a publicly trusted CA. Since 2018, Chrome has required newly issued publicly trusted certificates to appear in CT logs, or it won't trust them — this was introduced specifically to catch CAs issuing certificates they shouldn't have, including for domains without the owner's knowledge.
Why this benefits you directly
Because every certificate for your domain is logged publicly, you can monitor CT logs (via a tool like crt.sh) to see the instant any certificate is issued for your domain — including one you didn't request. This has become a genuinely useful early-warning system for detecting a compromised DNS or hosting account being used to issue fraudulent certificates.
Checking your own domain
Search your domain at crt.sh or a similar CT search tool. You should see every certificate you've knowingly issued (including old, expired ones) — anything unfamiliar is worth investigating immediately.
Why Chrome specifically requires it and what happens without it
Chrome will refuse to trust a newly issued publicly trusted certificate that lacks the required proof of CT log inclusion, regardless of whether the certificate is otherwise entirely validly issued — meaning a CA's failure to properly log a certificate, even by accident, results in that certificate simply not working for a large share of visitors.
Setting up ongoing monitoring rather than manual checks
Beyond manually searching crt.sh occasionally, several third-party services offer automated CT log monitoring with alerts sent the moment a new certificate is logged for a domain you specify — giving near-real-time notification of any issuance, legitimate or not, without needing to remember to check manually.
What information a CT log entry actually contains
A logged certificate's public CT entry includes the full certificate details, domain, issuer, validity dates, SAN entries, exactly as they'd appear if you viewed the certificate directly — nothing about CT logging is summarized or redacted, which is precisely what makes it useful for independent auditing.
How CT logs are structured to resist tampering after the fact
CT logs use a cryptographic Merkle tree structure, letting anyone verify a specific certificate is genuinely included and that the log hasn't been secretly altered or had entries quietly removed — this tamper-evident design is what makes the logs trustworthy despite being operated by various different organizations rather than one central authority.
What a pre-certificate is and why it exists in the CT process
Before issuing a final certificate, some CAs first log a pre-certificate, a nearly-identical version used specifically to obtain the Signed Certificate Timestamp proof needed for CT compliance, without which the final, real certificate wouldn't be trusted by CT-enforcing browsers like Chrome.
The single most useful thing a site owner can do with this system
Searching your own domain periodically at a CT log search tool costs nothing and takes seconds, yet it's the most direct, individually available way to catch an unauthorized certificate issued for your domain before it's used maliciously.
What a typical CT monitoring workflow looks like for a security-conscious organization
A mature CT monitoring setup typically includes automated, continuous log scanning for an organization's domains, an alerting system for any new, unrecognized certificate, and a documented response process for investigating and, if necessary, reporting an unauthorized issuance — treating this as an ongoing security practice rather than an occasional manual check.
A closing thought
A quick closing thought: CT logs are one of the few genuinely free, immediately actionable tools available to any site owner wanting direct insight into their own domain's certificate history — worth actually using, not just knowing about.