Setting up Certificate Transparency log monitoring had been on the team's backlog for months, filed under "probably fine, low priority" — the kind of task that survives multiple sprint plannings without ever quite becoming urgent. It finally got done mostly because an upcoming security audit specifically asked whether the company monitored CT logs for its own domains, and "no" felt like an uncomfortable answer to give in writing.
The monitoring went live on a Friday afternoon. By Sunday night, it had already done its job.
What actually showed up
An alert fired for a certificate issued for a subdomain the security team didn't recognize — not a typo of an existing subdomain, not a decommissioned one anyone remembered, just an unfamiliar name under the company's own domain. The certificate had been issued by a legitimate, well-known CA, which ruled out the CA itself doing anything wrong — CT logging is specifically designed to catch exactly this kind of situation, where a validly-issued certificate is still something the domain owner never actually authorized or expected.
The subdomain itself, once looked up, resolved to an IP address entirely outside the company's known infrastructure. It turned out to be tied to a marketing contractor's side project from over a year earlier — a subdomain that had been set up for a short-lived campaign, DNS delegation never fully cleaned up afterward, and someone (most plausibly, whoever still controlled that old hosting account) had just gotten around to requesting a certificate for it.
Not malicious, but still a real gap
Nobody on the security team believed this was an attack once the full picture came together — but that almost made it a more useful first catch than a dramatic one would have been. It surfaced a genuine, forgotten piece of DNS delegation that had been sitting unmonitored and unowned for over a year, fully capable of having a certificate issued under it by anyone who still had access, with zero visibility into that happening until this alert.
What changed afterward
The team removed the stale DNS delegation, and — more importantly — added a recurring quarterly review of every subdomain with active DNS records, cross-checked against what infrastructure the company actually still used. The CT monitoring stayed on permanently, no longer treated as an audit checkbox. Our CT Log Search tool covers the same underlying lookup this alert was built on, if you want to check your own domain's issuance history directly rather than waiting for automated monitoring to flag something.
This case study is written to illustrate a genuine, common troubleshooting pattern. It is not a direct quotation or a verified account tied to a specific, identifiable individual or company. For the underlying technical reference, see: What Is Certificate Transparency?
Loading comments…