Certificate Transparency

What is Certificate Transparency

Google’s Certificate Transparency (CT) project is an initiative to improve the security of the SSL/TLS certificate system. It introduces a publicly auditable log of SSL certificates to help detect and mitigate the impact of misissued, rogue, or malicious certificates as early as possible. By enabling transparency in certificate issuance, CT helps ensure that problems can be identified and corrected promptly.

Modern cryptography allows browsers to detect forged or fake SSL certificates. However, cryptographic checks alone are not sufficient when a valid certificate is issued mistakenly or when a certificate authority (CA) is compromised or acts maliciously. In such cases, the browser may still trust the certificate, misleading users into thinking they are securely connected to a legitimate website.

Purpose and Usage

Certificate Transparency aims to address these issues by making SSL/TLS certificate issuance visible and verifiable by domain owners, CAs, and the general public. It has three main goals:

• Prevent undetected misissuance: Make it extremely difficult for a CA to issue a certificate for a domain without the domain owner's knowledge.
• Enable monitoring and auditing: Provide tools and infrastructure for domain owners and CAs to audit and monitor certificate logs to detect misissued or unauthorized certificates.
• Protect end users: Help prevent users from being misled by certificates that appear valid but were mistakenly or maliciously issued.

Key Components of Certificate Transparency

The system relies on three main components:

• Certificate Logs: Public, append-only logs where CAs submit the certificates they issue. These logs are cryptographically verifiable and provide a tamper-proof history.
• Monitors: Entities that watch the logs for suspicious or unexpected certificates related to specific domains, helping detect misissuance.
• Auditors: Components (often part of browsers) that verify the integrity of logs and ensure that the data they provide hasn’t been tampered with.

ClouDNS and Certificate Transparency

Certificate Transparency is supported for all certificates issued by Sectigo. You can use the online tool by Sectigo located at this URL in order to check your SSL certificates.