Certificate Transparency

CT (RFC 6962) makes cert issuance auditable. Every cert issued by a public CA is published to public, append-only logs.

How:

1. Before issuing, CA submits the cert (or pre-cert) to one or more CT logs.
2. The log returns an SCT (Signed Certificate Timestamp) — proof of inclusion.
3. CA includes the SCT in the cert (as an X.509 extension) or delivers via TLS / OCSP.
4. Browsers verify the SCT before trusting the cert.

Why?

• Catches mis-issuance: someone audits the log and notices "google.com cert issued by Iranian CA?!"
• DigiNotar (2011) issued ~500 fake certs (Google, Yahoo, etc.) to Iranian state. CT didn't exist; took weeks to detect.
• Today, monitoring tools (Cert Spotter, crt.sh) alert orgs when a cert is issued for their domain.

Log structure:

• Append-only Merkle tree.
• Witnesses include consistency proofs across log states ("here's a proof the new tree is an extension of the old").
• Logs are operated by Google, Cloudflare, Sectigo, DigiCert, Let's Encrypt.

Cert pre-cert:

• Identical to final cert except signed by a "pre-cert poison" extension.
• Submitted to log; log returns SCT.
• CA strips poison extension, embeds SCT, re-signs as final cert.
• This is why a cert and its log entry have the same content but different signatures.

Browser policy:

• Chrome: requires SCTs from at least 2 logs (one Google, one non-Google) for certs issued after 2018.
• Safari/Firefox follow similar policies.
• Without valid SCTs: connection fails or warning displayed.

CT changed the security incentives. CAs face public scrutiny in real-time.