A valid HTTPS certificate can still be unexpected. Certificate Transparency logs provide a public record of certificates issued for your domains, and a scheduled web cron check can detect an unfamiliar issuance before it becomes a larger security incident.
What Certificate Transparency monitoring does
Public certificate authorities submit eligible certificates to append-only Certificate Transparency logs. Each entry includes certificate names, issuer details, validity dates, and a log timestamp. Monitoring searches these records for your registered domains and compares new entries with an approved inventory.
This is different from checking when a deployed certificate expires. Use SSL expiration monitoring to protect availability; use CT monitoring to learn when a certificate was issued, including certificates that may never be installed on your servers.
Define the domains and patterns you own
Start with registered domains and explicitly include expected subdomain patterns. Decide whether wildcard certificates, staging hosts, mail services, CDN hostnames, and managed platforms are allowed. Keep an inventory containing the certificate fingerprint, issuer, subject alternative names, validity period, environment, and responsible team.
Build a small monitoring endpoint
Create a protected endpoint that queries a reputable CT search source or consumes a monitored feed. Store the last processed log position or certificate identifier so each run examines only new entries. Normalize domain names, remove duplicates caused by precertificates, and compare results against the approved inventory.
{
"domain": "example.com",
"new_certificates": 1,
"approved": 1,
"unexpected": 0,
"status": "healthy"
}Return HTTP 200 when processing succeeds and no unapproved entry appears. Return a non-2xx status for an unexpected certificate, a stale checkpoint, repeated provider failures, or malformed data that prevents a trustworthy decision.
Avoid common false positives
- Recognize precertificate and final-certificate pairs.
- Account for legitimate renewals from automated certificate services.
- Map CDN and hosting-provider issuers to the domains they manage.
- Normalize uppercase, trailing dots, and internationalized domain names.
- Treat a new wildcard scope as higher risk than a routine renewal.
Schedule and secure the check
Run every 15 to 60 minutes, depending on the sensitivity of the domain. Protect the endpoint with an authorization header or unguessable route, restrict query targets to your inventory, and never return private credentials. Prevent overlapping runs with the pattern in How to Prevent Overlapping Cron Jobs.
Make alerts actionable
An alert should include the affected names, issuer, fingerprint, log timestamp, validity window, and whether the certificate expands the approved hostname scope. Do not attach private keys or internal secrets. Deduplicate alerts by fingerprint and keep the incident open until the certificate is approved, revoked, or confirmed harmless.
Investigate an unfamiliar certificate
- Confirm the entry in more than one CT source when possible.
- Check whether a hosting, CDN, email, or security vendor requested it.
- Compare DNS authorization and CAA records with the approved configuration.
- Contact the issuing authority when the issuance is not authorized.
- Revoke the certificate when appropriate and rotate exposed credentials.
- Review account access, API tokens, and domain-control validation paths.
Pair CT monitoring with DNS record change monitoring and HTTP security header checks. Together they cover issuance, domain control, and deployed browser protections.
Production checklist
- Maintain an approved certificate and issuer inventory.
- Persist a reliable log checkpoint and detect stale processing.
- Deduplicate precertificates, renewals, and repeated log entries.
- Alert immediately on unknown issuers or expanded hostname scope.
- Test the notification and incident runbook before relying on it.
Certificate Transparency monitoring does not block mis-issuance, but it shortens detection time. A focused web cron check turns a public security signal into a practical alert for the team that can respond.