Certificate Transparency

Certificate Transparency is a set of public append-only logs recording every certificate a publicly trusted authority issues. Browsers require modern certificates to appear in them, so a certificate issued for your domain is public whether or not you requested it.

The logs exist because of misissuance. Before them, a certificate authority could issue a certificate for any domain and nobody outside would know. Now every issuance is written to logs that anyone can read, and a domain owner can watch for names they did not ask for.

crt.sh is the search interface most people use. It is free, it is slow, and it has no supported API, which is the complaint behind every "crt.sh alternative" search.

What Domduck records

Nothing from the logs, today. Certificate Transparency is listed as an unimplemented source on the status page rather than left out, so the gap is visible instead of quiet.

What Domduck does record is the certificate the site actually serves, once a day, through self_tls. That answers a different question: the logs say what was issued, and the daily connection says what is in force.

Why it matters

The two views disagree in useful ways. A certificate in the logs that never appears in a connection was issued and not deployed, which is worth a look if you did not order it. A certificate in force whose issuer changed is a deployment change, and the log tells you when it was issued rather than when it went live.

For a domain owner the practical use is monitoring: subscribe to issuance alerts for your own names, and treat an unexpected entry as a control question rather than an emergency, because most surprises are a colleague using a different provider.