# What Is Precertificate (CT precertificate)?

> A precertificate is a deliberately unusable copy of a certificate, marked with a poison extension, that a CA logs in CT to obtain SCTs before final issuance.

Source: https://ssl.sh/glossary/precertificate/
Last updated: 2026-11-10

A precertificate, defined in [RFC 6962](https://www.rfc-editor.org/rfc/rfc6962), contains the same data as the certificate a CA intends to issue, plus a critical CT Precertificate Poison extension that makes ordinary clients reject it. The CA submits it to [CT logs](https://ssl.sh/glossary/ct-log/), collects the returned [SCTs](https://ssl.sh/glossary/sct/), and then signs the final certificate with those SCTs embedded in an extension. This solves a chicken-and-egg problem: a certificate cannot contain timestamps for itself.

## Why it matters
Embedded SCTs are the most common way certificates satisfy browser CT requirements, because they need no server configuration. Root programs also treat a logged precertificate as evidence that the CA intended to issue the matching certificate: if the precertificate violates the rules, it counts as [misissuance](https://ssl.sh/glossary/misissuance/) even if the final certificate was never issued or logged. When you search CT logs you will therefore often see two entries per certificate, the precertificate and the final certificate.

## Example
```bash
openssl x509 -in precert.pem -noout -text | grep -A1 "Poison"
```

A precertificate shows `CT Precertificate Poison: critical`. The final certificate lacks that extension and instead shows `CT Precertificate SCTs:` followed by the log IDs and timestamps it collected.

## Common misconceptions
- **Two CT entries mean the CA issued two certificates.** Usually one is the precertificate and the other the final certificate, with the same serial number.
- **A precertificate can be installed on a server.** The poison extension is marked critical, so clients refuse it.
- **The final certificate must also be logged.** Not necessarily: logging the precertificate and embedding its SCTs satisfies browsers, although some CAs log both.

## Related terms

- [证书透明度](https://ssl.sh/zh/glossary/certificate-transparency/): 证书透明度（CT）是一套公开、只可追加的日志系统，记录所有公开信任的 TLS 证书，让任何人都能审计 CA 签发了什么。
- [SCT](https://ssl.sh/zh/glossary/sct/): SCT 是 CT 日志签发的承诺凭证，表示它会把某张证书收录进公开日志，浏览器以此确认证书已提交记录。
- [CT 日志](https://ssl.sh/zh/glossary/ct-log/): CT 日志是由独立运营方维护、可公开审计且只可追加的服务器，用 Merkle 树记录证书，并签发承诺收录的时间戳。
- [X.509](https://ssl.sh/zh/glossary/x509/): X.509 是 ITU-T 制定的公钥证书标准格式，其互联网配置规范 RFC 5280 规定了 TLS 所用证书的结构和验证方法。
- [错误签发](https://ssl.sh/zh/glossary/misissuance/): 错误签发是指 CA 违反 Baseline Requirements 或根证书计划政策签发证书，从验证缺陷到字段格式错误都算在内。
- [证书颁发机构](https://ssl.sh/zh/glossary/certificate-authority/): 证书颁发机构（CA）是负责审核申请者、签发数字证书，并把公钥与域名或身份绑定在一起的机构。