CT log
also: Certificate Transparency log, CT, SCT (Signed Certificate Timestamp)
A Certificate Transparency log is a publicly auditable append-only record of SSL/TLS certificates, designed to detect and prevent the issuance of fraudulent digital certificates.
Certificate Transparency (CT) logs are open, distributed ledgers maintained by trusted operators (often CAs and independent services) that record every SSL/TLS certificate issued for public domains. Each certificate submission creates a cryptographically signed entry that cannot be modified or deleted.
CT logs help detect unauthorized or fraudulent certificates by allowing domain owners and security researchers to monitor what certificates have been issued for their domains. For example, if you own example.com, you can query CT logs to see all certificates issued for *.example.com or subdomains, immediately spotting suspicious activity.
Modern browsers require CT log proof (in the form of Signed Certificate Timestamps, or SCTs) for certain certificate types to validate their legitimacy. This provides transparency and accountability in the certificate issuance process, reducing the risk of man-in-the-middle attacks caused by compromised or rogue CAs.