# What Is CT Log (Certificate Transparency log)?

> A CT log is a publicly auditable, append-only server that records certificates in a Merkle tree and issues signed timestamps promising to include them.

Source: https://ssl.sh/glossary/ct-log/
Last updated: 2026-11-10

A CT log is a server, run by an independent operator, that accepts certificates and [precertificates](https://ssl.sh/glossary/precertificate/) from CAs, appends them to a Merkle tree and returns a [Signed Certificate Timestamp](https://ssl.sh/glossary/sct/). The log periodically publishes a signed tree head (STH). Anyone can request inclusion proofs, showing that a certificate is in the tree, and consistency proofs, showing that the tree only grew and was never rewritten. Each log commits to incorporating new entries within a maximum merge delay.

## Why it matters
Browsers do not accept SCTs from just any log: each log must be admitted to browser CT policies, such as Chrome's and Apple's, and is monitored for misbehavior. A log that shows different views to different parties, or misses its merge deadline, can be disqualified, after which its SCTs stop counting. Logs are usually temporally sharded, with a separate log for certificates expiring in each period, so old shards can be frozen and retired. Operators have included Google, Cloudflare, DigiCert, Sectigo and Let's Encrypt, which together make [Certificate Transparency](https://ssl.sh/glossary/certificate-transparency/) independent of any single company.

## Example
Logs following RFC 6962 expose a simple HTTP API. Fetch the current tree head:

```bash
curl -s https://ct.example.com/ct/v1/get-sth
```

The JSON reply contains tree_size, timestamp, sha256_root_hash and tree_head_signature. Monitors poll this endpoint and download new entries with get-entries. Some newer logs, such as those running Let's Encrypt's Sunlight software, instead serve the tree as static tiles.

## Common misconceptions
- **There is one central CT log.** There are many independent logs, and browsers require SCTs from several distinct operators.
- **A CT log validates certificates.** A log only checks that a submission chains to a root it accepts; judging whether issuance was correct is the job of monitors.
- **Being logged means a certificate is legitimate.** Logging is required for browser acceptance but says nothing about whether the CA should have issued it.

## Related terms

- [证书透明度](https://ssl.sh/zh/glossary/certificate-transparency/): 证书透明度（CT）是一套公开、只可追加的日志系统，记录所有公开信任的 TLS 证书，让任何人都能审计 CA 签发了什么。
- [SCT](https://ssl.sh/zh/glossary/sct/): SCT 是 CT 日志签发的承诺凭证，表示它会把某张证书收录进公开日志，浏览器以此确认证书已提交记录。
- [预证书](https://ssl.sh/zh/glossary/precertificate/): 预证书是 CA 在正式签发前提交到 CT 日志的证书副本，带有“毒化”扩展而无法使用，用来换取 SCT。
- [证书颁发机构](https://ssl.sh/zh/glossary/certificate-authority/): 证书颁发机构（CA）是负责审核申请者、签发数字证书，并把公钥与域名或身份绑定在一起的机构。
- [哈希函数](https://ssl.sh/zh/glossary/hash-function/): 哈希函数（密码学哈希函数）把任意长度的输入映射为固定长度的摘要，且在计算上无法逆推输入，也无法找到摘要相同的两个输入。
- [错误签发](https://ssl.sh/zh/glossary/misissuance/): 错误签发是指 CA 违反 Baseline Requirements 或根证书计划政策签发证书，从验证缺陷到字段格式错误都算在内。