Certificate Transparency logs record millions of certificates a day. A naive brand query returns a stream nobody can work, and the tuning that makes it usable is where most CT monitoring succeeds or fails.
Where the noise comes from
| Source | Why it floods |
|---|---|
| Renewals | A 90-day certificate renewed automatically produces an entry every 60 days, for every name you own. |
| Precertificates | Each issuance is logged twice — a precertificate and the certificate. Naive counting doubles everything. |
| Multiple logs | The same certificate is submitted to several logs, so it appears several times. |
| Substring matches | A brand string that is also a common word matches thousands of unrelated names. |
| Your own infrastructure | Every subdomain you legitimately certify appears, forever, on every renewal. |
Making it usable
1. Deduplicate by certificate fingerprint. Kills the precertificate and multi-log duplication at a stroke — usually a 3-4x reduction. 2. Allowlist names you control. Your own renewals are the single largest source of volume and carry no information. 3. Alert on FIRST SEEN only. A name that appeared last month reappearing on renewal is not a new finding. 4. Match on the permutation watchlist, not on a substring of the brand. Substring matching is what produces the firehose. 5. Escalate on the combination, not the entry. new name + resolves + MX -> page someone new name only -> queue it
Substring matching is the trap
- A brand string that appears inside ordinary words matches endlessly —
%northwind%also matchesnorthwinds-sailing-club.example. - Matching against the cut-down permutation watchlist instead turns an unbounded query into a bounded one.
- Keep a small substring query as a secondary, low-priority feed. It catches combosquats the generator never produced, and it should never page anyone.
Measure the queue, not the coverage
The useful metric is how many CT findings a human looked at last week and what fraction led to action. A programme reporting ten thousand matched entries and two investigations has a tuning problem, not a coverage success — and the fix is always at steps 1 to 4 above rather than in more monitoring.