# What Is Certificate Transparency (CT)? Definition and Examples

> Certificate Transparency is a system of public, append-only logs recording publicly trusted TLS certificates so anyone can audit what CAs issue.

Source: https://ssl.sh/glossary/certificate-transparency/
Last updated: 2026-11-10

Certificate Transparency (CT), defined in [RFC 6962](https://www.rfc-editor.org/rfc/rfc6962) and revised as CT v2 in RFC 9162, requires CAs to submit certificates to public [CT logs](https://ssl.sh/glossary/ct-log/) built as Merkle trees, which can be appended to but not rewritten. Each log returns a [Signed Certificate Timestamp](https://ssl.sh/glossary/sct/), a promise to include the entry, which is embedded in the certificate or delivered during the handshake. Monitors watch the logs continuously, and anyone can search them.

## Why it matters
Before CT, a CA could issue a certificate for your domain and nobody would know unless it was used in an attack. Now browsers refuse certificates that lack valid SCTs: Chrome requires CT for certificates issued after 2018-04-30, and Apple for those issued after 2018-10-15. That makes [misissuance](https://ssl.sh/glossary/misissuance/) visible, gives root programs evidence when they decide whether to keep trusting a CA, and lets domain owners detect certificates they did not request.

## Example
Check that a certificate carries embedded SCTs:

```bash
openssl x509 -in cert.pem -noout -text | grep -A3 "CT Precertificate SCTs"
```

To list every certificate ever logged for example.com and its subdomains, query a CT search tool. Researchers and attackers use the same technique to enumerate hostnames.

## Common misconceptions
- **CT prevents misissuance.** It only makes issuance public and detectable; prevention relies on CAA, validation rules and audits.
- **Internal hostnames stay private if the certificate is only used internally.** Every publicly trusted certificate is logged, so the names in its SAN become public. Use a wildcard certificate or a private CA for names you do not want disclosed.
- **Only CAs need to care about CT.** Domain owners benefit most, by monitoring logs for certificates they did not expect.

## Related terms

- [CT 日志](https://ssl.sh/zh/glossary/ct-log/): CT 日志是由独立运营方维护、可公开审计且只可追加的服务器，用 Merkle 树记录证书，并签发承诺收录的时间戳。
- [SCT](https://ssl.sh/zh/glossary/sct/): SCT 是 CT 日志签发的承诺凭证，表示它会把某张证书收录进公开日志，浏览器以此确认证书已提交记录。
- [预证书](https://ssl.sh/zh/glossary/precertificate/): 预证书是 CA 在正式签发前提交到 CT 日志的证书副本，带有“毒化”扩展而无法使用，用来换取 SCT。
- [错误签发](https://ssl.sh/zh/glossary/misissuance/): 错误签发是指 CA 违反 Baseline Requirements 或根证书计划政策签发证书，从验证缺陷到字段格式错误都算在内。
- [证书颁发机构](https://ssl.sh/zh/glossary/certificate-authority/): 证书颁发机构（CA）是负责审核申请者、签发数字证书，并把公钥与域名或身份绑定在一起的机构。
- [CRLite](https://ssl.sh/zh/glossary/crlite/): CRLite 是 Mozilla 为 Firefox 打造的压缩吊销数据集，浏览器无需联系 CA，就能在本地判断公开记录的证书是否已被吊销。
- [CAA 记录](https://ssl.sh/zh/glossary/caa/): CAA 记录是一种 DNS 记录，用来声明哪些证书颁发机构可以为该域名签发证书，所有公共 CA 签发前都必须检查。