Certificate Transparency was built to catch mis-issuance by certificate authorities. A side effect is that it is now one of the best available feeds for finding infrastructure being stood up against you — usually before it is used.
What it is
CT is a set of public, append-only, cryptographically verifiable logs of issued certificates (RFC 9162). Browsers require evidence that a certificate was logged before they will trust it, so in practice every publicly trusted certificate is in a public log.
The logs are append-only and anyone may read them. The design goal was accountability for CAs; the practical consequence is a public, near-real-time record of new names being brought into service anywhere on the internet.
What an entry tells you
| Field | Use |
|---|---|
| Subject and SAN names | Every hostname the certificate covers. This is the useful part. |
| Issuer | Which CA. A free automated CA is not itself suspicious — it is what most of the internet uses. |
| Not before / not after | Validity period. "Not before" is a good proxy for when the infrastructure was set up. |
| Log timestamp | When it was logged, usually within seconds of issuance. |
Two uses, and the second is underrated
Watching for names like yours finds lookalike domains getting ready to serve content. Watching for names under your own domain finds hostnames you did not authorise — shadow IT, a forgotten environment, or somebody who has taken over a dangling record. The second is a genuinely high-signal control and costs nothing.
Using it
Public search interfaces index the logs and are queryable without an account. For a one-off check, search for your own domain and look at the SAN lists for hostnames you do not recognise. For continuous use, the logs can be streamed and filtered.
# for each hostname CT shows under your domain that you do not recognise: dig +short A unexpected.example.com # is it live dig +short CNAME unexpected.example.com # does it point somewhere third-party curl -sI https://unexpected.example.com # what is served (interaction — see below)
What CT does not tell you
- That a domain is malicious. A certificate means somebody proved control of a name. Most certificates are entirely ordinary.
- That a domain is in use. Certificates are issued in advance and often for names that never serve anything.
- Who registered it. Domain-validated certificates carry no identity information beyond control of the name.
- About domains with no certificate. A mail-only phishing domain may never obtain one and will not appear at all.
The volume problem is the real obstacle
Millions of certificates are logged daily. A naive filter on your brand name returns a continuous stream dominated by legitimate certificates for your own hosts, your CDN, your vendors, and unrelated organisations whose names happen to contain your string. Untuned CT monitoring produces alert fatigue within days, and the next lesson is about scoping it so that it does not.
Where it is strongest
CT is most valuable combined with other signals rather than alone. A domain that is recently registered, resembles your brand, has just obtained a certificate, and has an MX record is a much stronger finding than any one of those on its own. That combination is what the next lesson builds a monitoring scope around.