Certificate Transparency is a system that requires certificate authorities to submit newly-issued SSL/TLS certificates to public, cryptographically-maintained logs. These logs create an append-only record of every certificate, making it possible to audit CAs for misissuance and detect potentially fraudulent certificates quickly.
How it works
When a CA issues a certificate, it first creates a precertificate (a draft with a poison extension) and submits it to a CT log. The log returns a Signed Certificate Timestamp (SCT) — a cryptographic promise to include the certificate within a fixed timeframe. The CA then issues the final certificate, and must serve proof of CT inclusion (the SCT) to browsers.
Logs themselves are Merkle Trees; this mathematical structure means any log attempting to show different data to different people can be efficiently detected by comparing tree roots and consistency proofs. Verification of certificate inclusion happens in logarithmic time — fast enough not to slow down TLS Handshakes.
Browser and CA requirements
Chrome requires all certificates issued after April 30, 2018, to appear in a CT log. Firefox requires CT log inclusion for certificates issued by CAs in Mozilla's Root CA Program. Most modern browsers enforce similar requirements, making CT submission non-optional for any CA issuing publicly-trusted certificates.
TipCT logs are publicly queryable — you can search existing logs to see which certificates have been issued for any domain, which is useful for security monitoring and threat detection.
Certificate Transparency was standardized in RFC 6962 (2013) and updated in RFC 9162 (2021), though only RFC 6962 is implemented in production.