What is certificate transparency?

How it works

Issuance is written down where everybody can read it.

When a certificate is issued, it is submitted to logs that accept entries and never remove them. Anybody can read those logs, which means anybody can search for certificates covering a name they care about, including you searching for your own.

The property that matters is that the record cannot be revised. An entry that exists stays, so a mistaken or improper issuance leaves a permanent trace even if the certificate itself is later revoked, which is a separate mechanism covered under certificates.

Why it matters

Two consequences, and the second is regularly overlooked.

• Unexpected issuance becomes visible

  If an authority issues a certificate for your domain that you did not request, the entry is public. Watching those logs for your own names is the cheapest monitoring available for a class of problem that used to be undetectable, and services exist that do the watching and notify you.

• Your names become public as you use them

  The logs record what was issued, including hostnames, so internal-sounding names on certificates are published by the act of issuing. Anything you would rather not announce should either not appear in a public certificate at all, or be covered by a certificate that does not enumerate it individually, which is a decision to make before issuance rather than after.

That second point surprises teams who assume an unpublished name is effectively private. It was never private; it was merely unlisted, and issuing a certificate lists it.

When a browser complains about it

The message naming this mechanism means the client expected the certificate to be accompanied by evidence of logging and did not find it.

The cause is on the serving side rather than with the visitor, and it is usually a certificate obtained in a way that skipped the step, or a chain assembled without the accompanying evidence. Automated issuance normally handles this without anybody thinking about it, which is one of the quieter arguments for it, described under ACME. The message itself, and what to do when a visitor reports it, belongs to errors.

Related terms

Certificates themselves are under certificates, automated issuance under ACME, and the rest of the vocabulary in this glossary.