Certificate Transparency (CT Log Watch)¶

Public certificate authorities log every certificate they issue in Certificate Transparency (CT) logs. CT Log Watch (the Certificate Transparency page) polls a CT aggregator for the domains you watch and lists the certificates issued for them, so you can spot a certificate that nobody in your team asked for.

CT monitoring is a plan feature, included in the Business and Enterprise plans. The ct permission (read, create, update, delete) controls who can see the findings and manage the watched domains; see Organizations, users & roles. The platform operator also has to turn CT lookups on; until then the page says that lookups are disabled, and domains can be added in the meantime.

Watching a domain¶

Choose Manage domains on the CT Log Watch page and add the domain, optionally with its subdomains. Each poll stores the certificates the aggregator returns. Select a row for the full detail: names, issuer, validity, serial and the logs that carry it. Precertificates are marked precert.

CT findings stay on this page. They are not added to the Certificates inventory until another source - an endpoint probe, an internal scan or a renewal report - observes the certificate.

What CertIntel already knows¶

CertIntel compares every CT entry with what it already holds. The comparison uses only stored data and never makes another request to the aggregator, so it does not change the aggregator's rate limits or the poll budget.

Certificates are matched by SHA-256 fingerprint. A precertificate hashes differently from its final certificate, so precertificates (and entries without a fingerprint) are matched by issuer and serial number instead.

New name sets only filters the list to the third kind (/ct?novel=1).

New name set alerts¶

A name set is the sorted, lower-cased set of DNS names on a certificate. The ct.new_name_set alert (New name set in Certificate Transparency, in the Certificate Transparency group of Alerts) is a digest category: each digest lists the name sets first seen since the destination's previous digest that are neither issued by CertIntel nor in the inventory, with a link to each finding.

• Baseline. The first poll of a newly watched domain only records what already exists and never alerts. The same applies to the first poll of a domain watched before name sets were tracked, so turning the feature on does not alert on every certificate you already have.
• Late reports. An Agent may report a renewal after the CT poll saw the certificate. Name sets are therefore checked again just before a digest or report lists them, and a certificate reported in the meantime drops out.
• Names only. An entry without DNS names never alerts.
• A set is judged once. A name set counts as known as soon as any certificate carrying it is issued by CertIntel or in the inventory. A later certificate with exactly the same names does not raise the alert again, even from another CA; review the CT Log Watch list itself for that case.
• Plan gate. The alert is sent only for organizations whose plan includes CT monitoring.

New alert destinations have ct.new_name_set selected by default. Existing destinations do not; tick it on each destination that should receive it.

Weekly report section¶

Scheduled reports can include Certificate Transparency findings since the last report. The section shows how many name sets were first seen in the period - new, issued by CertIntel and already in the inventory - and lists the new ones with a link to each. It covers only organizations whose plan includes CT monitoring; otherwise it says so.

API¶

GET /api/v1/ct-findings and GET /api/v1/ct-findings/{id} include three booleans on each finding: issued_by_certintel, in_inventory and new_name_set. See the API overview.

Related pages¶

• Certificates
• Alerts & notifications
• Organizations, users & roles