Certificate Transparency

Certificate Transparency (RFC 6962)

Certificate Transparency (CT) is a framework defined in RFC 6962 that provides an open, auditable log of all issued TLS/SSL certificates. CT helps detect misissued or rogue certificates.

Overview

CT works by requiring Certificate Authorities to submit certificates (or pre-certificates) to public CT logs before or after issuance. The logs return Signed Certificate Timestamps (SCTs) that prove the certificate was logged.

How UCM Supports CT

SCT Awareness

UCM displays SCT information when present in certificates:

• Embedded SCTs — SCTs included in the certificate's SignedCertificateTimestampList extension (OID 1.3.6.1.4.1.11129.2.4.2)
• Certificate detail view — Shows CT log entries and timestamps when SCT data is available
• Discovery — Identifies certificates with or without SCT extensions during network scanning

CT Log Verification

When viewing certificate details, UCM parses and displays:

• CT log operator name (if recognized)
• SCT timestamp
• SCT signature algorithm
• Log ID (SHA-256 hash of the log's public key)

CT in the PKI Ecosystem

Why CT Matters

1. Transparency — All publicly trusted certificates are logged and auditable
2. Detection — Domain owners can monitor logs for unauthorized certificates
3. Accountability — CAs that misissue certificates can be identified
4. Browser requirements — Chrome, Safari, and other browsers require SCTs for trusted certificates

CT Requirements by Browser

Browser	CT Required	SCTs Needed
Chrome	Yes (since 2018)	2-3 SCTs from independent logs
Safari	Yes (since 2021)	2 SCTs from once/currently qualified logs
Firefox	No (planned)	N/A

CT for Internal PKI

CT is primarily relevant for publicly trusted certificates. For internal/private PKI:

• Internal CAs are not required to log to public CT logs
• Private CT logs can be deployed for internal audit purposes
• UCM can issue certificates without SCTs for internal use

Monitoring Certificate Transparency

External CT Monitoring Tools

• crt.sh — Search CT logs for certificates issued to your domains
• Google CT Dashboard — Google's CT log statistics
• Facebook CT Monitor — Alerts for new certificates

Setting Up Monitoring

To detect unauthorized certificate issuance for your domains:

1. Visit crt.sh and search for your domain
2. Set up alerts via services like Cert Spotter or Facebook CT Monitor
3. Review alerts for any unexpected certificates

See Also

• Certificate Operations — Managing certificates
• Certificate Discovery — Discovering certificates on your network
• RFC 6962 — Certificate Transparency specification
• RFC 9162 — Certificate Transparency Version 2.0