# What Is SCT (Signed Certificate Timestamp)?

> An SCT is a CT log's signed promise to add a certificate to its public log, which browsers require as proof that the certificate was submitted for logging.

Source: https://ssl.sh/glossary/sct/
Last updated: 2026-11-10

An SCT (Signed Certificate Timestamp) is a small data structure returned by a [CT log](https://ssl.sh/glossary/ct-log/) when a CA submits a certificate or [precertificate](https://ssl.sh/glossary/precertificate/). It contains the log ID, a timestamp and the log's signature, and promises that the entry will appear in the log within the maximum merge delay. Clients verify the signature using the log's public key from their CT policy list. SCTs reach clients in three ways: embedded in the certificate (by far the most common), in a TLS extension during the [handshake](https://ssl.sh/glossary/tls-handshake/), or inside a stapled OCSP response.

## Why it matters
Chrome and Apple reject publicly trusted certificates without enough valid SCTs; Chrome requires CT for certificates issued after 2018-04-30 and Apple for those issued after 2018-10-15. Their policies demand SCTs from multiple distinct log operators, with the required number depending on certificate lifetime. SCT timestamps are also used in distrust decisions: Chrome 131+ distrusts Entrust TLS certificates whose earliest SCT is after 2024-11-11, a cut-off a CA cannot backdate because the log, not the CA, signed the time.

## Example
```bash
openssl x509 -in cert.pem -noout -text | grep -A12 "CT Precertificate SCTs"
```

Each entry lists Version, Log ID, Timestamp and Signature. A certificate from a public CA typically carries two or three entries from different logs.

## Common misconceptions
- **An SCT proves the certificate is in the log.** It is a signed promise; an inclusion proof from the log confirms it later.
- **Site operators have to configure SCTs.** With embedded SCTs the CA handles everything; only the TLS-extension method needs server support.
- **An SCT vouches for the certificate's validity.** Logs do not check whether issuance was proper; they only record it.

## Related terms

- [证书透明度](https://ssl.sh/zh/glossary/certificate-transparency/): 证书透明度（CT）是一套公开、只可追加的日志系统，记录所有公开信任的 TLS 证书，让任何人都能审计 CA 签发了什么。
- [CT 日志](https://ssl.sh/zh/glossary/ct-log/): CT 日志是由独立运营方维护、可公开审计且只可追加的服务器，用 Merkle 树记录证书，并签发承诺收录的时间戳。
- [预证书](https://ssl.sh/zh/glossary/precertificate/): 预证书是 CA 在正式签发前提交到 CT 日志的证书副本，带有“毒化”扩展而无法使用，用来换取 SCT。
- [TLS 握手](https://ssl.sh/zh/glossary/tls-handshake/): TLS 握手是 TLS 连接开始时的一组消息交换，客户端与服务器在其中协商协议版本和密码套件、验证服务器身份并派生会话密钥。
- [OCSP Stapling](https://ssl.sh/zh/glossary/ocsp-stapling/): OCSP Stapling 是 TLS 服务器把 CA 签名、带有效期的 OCSP 响应随握手一起发给客户端的机制，浏览器因此不必再自己去问 CA。
- [取消信任](https://ssl.sh/zh/glossary/distrust/): 取消信任是根证书计划作出的决定：不再信任某家 CA 的证书，可能是全部证书，也可能只针对截止日期之后签发的证书。