Certificate transparency logs record publicly trusted certificates issued for domain names. They can help a team notice unexpected certificates or names that deserve review. A log entry is a clue about certificate issuance, not proof that a website has been compromised.
Understand the idea
Monitor the domains your organization owns and define who reviews unfamiliar entries. Compare a finding with known hosting, certificate renewals, and supplier activity. Keep an inventory of expected services so an alert can be explained without guessing. Some legitimate services create names or certificates unfamiliar to everyday users.
- Observe
Watch certificate records for the relevant domain scope.
- Match
Compare unfamiliar names and issuers with known operations.
- Investigate
Review ownership, issuance, and any necessary corrective action.
A practical example
Imagine a new certificate appearing for an organization’s subdomain. The administrator checks the hosting inventory and learns that a planned service deployment created it. Another unexplained entry would receive further review with the domain and certificate providers.
What to do next
- Inventory the domains you control, certificate owners, and authorized issuing or hosting arrangements.
- Monitor new matching entries through a reputable supported service or tooling.
- Compare alerts with scheduled renewals, new applications, and provider changes.
- Escalate unexplained issuance to the responsible domain and certificate owners.
- Preserve the relevant entry and investigation outcome rather than simply dismissing repeated alerts.
How to check the result
Record the explanation and any action taken. Combine the logs with ownership and deployment evidence; they do not show every private certificate or establish who controls all related systems.
An unfamiliar subdomain appears in a certificate record.
Check whether it belongs to a legitimate service, provider, or historical deployment. Establish context before treating the entry as evidence of a breach.
Sources and useful guides
The following resources provide background and more detailed guidance. Use the sections that match your service and situation.
