Certificate Transparency
Append-only public logs of every TLS certificate issued.
Origin
Ben Laurie and Adam Langley at Google proposed CT in 2012 in response to the 2011 DigiNotar incident. RFC 6962 (2013) standardised it; RFC 9162 (2021) is the v2. Browsers refuse certs without an SCT today.
Where it shows up in production
- crt.sh & Censys Search-the-logs services. Type your domain and see every TLS cert ever issued for it.
- Cloudflare Merkle Town Public dashboard summarising the cert ecosystem from the CT logs.
- Let's Encrypt Every issued cert gets a CT log entry within minutes — driving the audit trail for ~50% of the web.
On Semicolony
Sources & further reading
Found this useful?