Someone Can Get an SSL Certificate for Your Domain. CT Logs Are How You Find Out.
Here is a failure your monitoring is built to miss. Somebody — an attacker who briefly controlled your DNS, a subdomain you forgot you delegated, an ex-vendor whose access was never revoked, or a phishing operator standing up login.yourbrand.com on infrastructure you don't own — gets a certificate authority to issue a valid, publicly-trusted TLS certificate for a name under your domain. It is a…
Certificate Transparency (CT) is a public, append-only log that records all issued TLS certificates. When a Certificate Authority (CA) issues a certificate, it submits it to CT logs, which then store a signed certificate timestamp (SCT) proving the certificate has been publicly recorded. Browsers only trust certificates that have been logged, so an unauthorized certificate will still appear in CT logs.
Common ways unauthorized certificates are issued are through domain-validation abuse, subdomain takeovers, and forgotten or mismanaged services. To detect unauthorized certificates, regularly check CT logs using tools like crt.sh or the certspotter API. Any unexpected certificate should be reported to the CA for revocation and the responsible access should be revoked.
Continuous monitoring of CT logs is essential for early detection and mitigation of unauthorized certificates.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
