Certificate Transparency

Certificate Transparency, also called CT, records TLS certificates in public, append-only logs. Domain operators and other monitors can inspect the logs for unexpected issuance by a certificate authority. Client policies can require evidence of logging before accepting a certificate. Logging alone does not prevent fraudulent issuance or revoke a certificate. Client enforcement and monitoring provide different protections. CT complements CAA: CAA guides issuer authorization before issuance, while CT exposes logged certificates for inspection afterward.