CT Logs: a beginner's guide

Certificate Transparency (CT) is a system, launched by Google in 2013 and required by Chrome since 2018, that publishes a public, append-only log of every SSL certificate issued by every public certificate authority. The point of CT is to make certificate mis-issuance impossible to hide. Before CT, a CA could be tricked or coerced into issuing a fraudulent certificate for a high-value domain (say, `google.com` or `bankofamerica.com`), and the certificate could be used for an attack without the legitimate domain owner ever knowing. With CT, every issuance is logged publicly within hours. Anyone — including the legitimate domain owner — can monitor the logs and see new certificates as they are issued.

You should care because CT logs are the only way to detect that someone has obtained a fraudulent certificate for your domain before it gets used in an attack. Setting up monitoring is easy: anyone can subscribe to alerts for their domain via free services that watch the logs and email you whenever a new cert appears. For brands, banks, or any organization where impersonation would be a serious incident, this monitoring is one of the cheapest pieces of security infrastructure available. It is also the basis for an entire category of security research — academic papers regularly use CT log data to study CA behavior, detect mis-issuance, and find misconfigured certificates across the public internet.

The five things every CT log check looks at:

• What certificates have been issued for this domain in the last N days? A baseline answer is the starting point for any audit.

• Are there any unexpected certificates? Certificates from CAs you don't use, for subdomains you don't own, or with timestamps you can't account for, are red flags.

• Are there any wildcard certificates you didn't authorize? Wildcards have outsized blast radius and warrant extra scrutiny.

• Is the issuance velocity normal? A sudden spike in new certificates is suspicious — and can also be a sign of a misconfigured CI/CD pipeline issuing duplicates.

• Are there any pre-certificates (the staging step) that were never finalized? These can indicate a failed issuance attempt that may be worth investigating.

Three questions a CT log check answers:

• Has any certificate authority issued a certificate for my domain in the last week?

• Are any of those certificates from a CA I don't use, or for a subdomain I didn't authorize?

• Is anyone trying to impersonate my brand by getting a cert for a similar-looking domain?

The cost of skipping CT log monitoring is the small but real risk that a fraudulent certificate gets issued and used against your brand without you ever finding out until after the damage. The fix is to subscribe to a free CT monitoring service (or build your own using public log feeds). The CT specification is in RFC 6962, and the public logs are queryable at crt.sh and other transparency search engines.

In one sentence: Search Certificate Transparency logs

Searches Certificate Transparency (CT) logs for recent certificates issued for a domain via the crt.sh aggregator. Returns up to 20 deduplicated entries. Unlike the SSL (Secure Sockets Layer) endpoint which analyzes the active certificate, this searches historical records across CT logs (Certificate Transparency logs) aggregated by crt.sh.

Don't worry if some of the words above are still unfamiliar — there's a plain-language glossary at the bottom of this page, and most of the terms link to their own beginner guides if you want to learn more.

Here's what's actually happening behind the scenes when you call this endpoint:

Queries Certificate Transparency log aggregators (crt.sh) for recent certificates issued for the domain. Returns up to 20 deduplicated entries with issuer name, log entry timestamp, and crt.sh certificate ID. The truncated field indicates if more entries exist beyond the limit.

If you're using an AI assistant through MCP, you don't need to understand any of the technical details — the assistant calls the tool and translates the result for you.

Let's skip the marketing fluff and answer the only question that actually matters: why should you, a real human with a real to-do list, care about the CT Logs tool? Here's the plain-English version, written the way you'd hear it from a friend who happens to do this for a living.

Recent CT log entries reveal patterns invisible in the active certificate alone: CA changes over time, certificate churn rates, subdomain discovery through historical SANs, and detection of unauthorized issuance. The truncated field indicates when more entries exist beyond the 20-entry limit.

Picture this in real life. Imagine a security researcher. Here's the situation they're walking into: Discover subdomains from expired and historical certificates that no longer appear in the active certificate or DNS (Domain Name System) records. Without the right tool, that person would be stuck copy-pasting between five browser tabs, reading documentation written for engineers, and crossing their fingers that the answer they cobble together is correct. With the CT Logs tool, the same person gets a clear answer in seconds — no spreadsheets, no guessing, no waiting for someone on the infrastructure team to free up.

Three questions this tool answers in plain English. If any of these have ever crossed your mind, the CT Logs tool is built for you:

• Is my website encrypted properly, or are visitors going to see a scary browser warning?

• Am I missing any of the security headers that modern browsers expect?

• Could a known weakness on my site quietly be costing me trust, traffic, or compliance?

You can either click the tool and get the answer yourself, or ask your AI assistant — connected through MCP (Model Context Protocol) — to ask the question for you and translate the answer into something you can paste into Slack.

Who gets the most out of this. Founders and freelancers running their own sites, agencies handing off projects to clients, security and compliance teams chasing audit findings, and developers hardening login pages. If you see yourself in that list, this is one of the EdgeDNS tools you should bookmark today.

What happens if you skip this entirely. Skip it and visitors get browser warnings, search engines lose trust in your site, and a single missed setting can become a public security incident. That's why running this check — even once a month — is one of the cheapest forms of insurance you can give your domain.

If you're still on the fence about whether the CT Logs tool belongs in your toolbox, this section is for you. Below you'll meet three real people — a security researcher, a security operations, and a PKI administrator — facing three real situations where this tool turns a stressful afternoon into a five-minute task. Read whichever story sounds closest to your week.

Story 1: Historical Subdomain Enumeration

Imagine you're a security researcher. Discover subdomains from expired and historical certificates that no longer appear in the active certificate or DNS (Domain Name System) records.

Why it matters: Find forgotten subdomains and legacy infrastructure not visible through current DNS (Domain Name System) enumeration.

Story 2: Unauthorized Issuance Detection

Imagine you're a security operations. Search CT log history for certificates issued by unauthorized CAs or for unexpected subdomains.

Why it matters: Detect rogue certificate issuance that could indicate domain compromise or CA misbehavior.

Story 3: Certificate Lifecycle Analysis

Imagine you're a PKI administrator. Analyze CA usage patterns over time — certificate rotation frequency, issuer changes, and automation effectiveness.

Why it matters: Optimize certificate management by identifying lifecycle patterns and automation gaps.

Common situations across teams. Beyond the three stories above, here are the everyday workplace moments when people across the company reach for the CT Logs tool — or one of the tools right next to it in this category. If any of these are on your calendar this month, that's your sign:

• After every site redesign or platform migration.

• Before a penetration test, security review, or vendor questionnaire.

• When your SSL certificate is about to expire and you want to confirm the renewal worked.

• On a recurring monthly schedule, so you catch new issues before attackers do.

If you can see yourself in even one of those bullets, the CT Logs tool will pay for itself the first time you use it.

Still not sure? Here's the easiest test in the world. Open Claude, ChatGPT, Gemini, or any other AI assistant connected to the EdgeDNS MCP server and ask, in your own words: "Is the CT Logs tool useful for my job?" The assistant will look at the tool, ask you a couple of follow-up questions about what you're trying to accomplish, and give you a straight answer in plain English. No commitment, no signup forms, no jargon.

If you've connected the EdgeDNS MCP server to Claude, ChatGPT, Gemini, Cursor, or any other AI assistant, you don't need to write any code. Just ask in plain English:

"Use the CT Logs tool to check example.com and explain anything that looks wrong in plain language."

The AI will figure out which tool to call, fill in the right parameters, run it, and then explain the result back to you. No copy-pasting between tabs. No reading raw JSON. No memorizing endpoint names.

If you're a developer and want to call the endpoint from a script or your own application, here's the simplest possible example. Replace the placeholder API key with the real one from your dashboard.

There's just one piece of information you need to provide. The table below explains exactly what it is and what a real value looks like.

When you call this tool, you'll get back a JSON object with the fields below. If you're talking to it through an AI assistant, the assistant reads these for you and explains them in plain language — you don't need to memorize them.

These tools pair naturally with CT Logs. If you're already running this check, the related ones often answer the next question that comes up:

• SSL Certificates — Analyze active SSL/TLS certificate details

• OCSP Status — Check TLS certificate trust and OCSP responder information

• CAA Records — Check which CAs can issue certificates

If you're using an AI assistant through MCP (Model Context Protocol), you can ask it to run several of these in one go: "Check CT Logs and the related tools for example.com and tell me what looks off."

If any words on this page felt like jargon, here's a plain-language version. Click any linked term to read a full beginner-friendly guide.

DNS (Domain Name System) — The internet's address book. When you type a website name, DNS turns it into the actual numeric address computers use to find each other.

SSL (Secure Sockets Layer) — The original encryption used by HTTPS. The name stuck even though every modern site actually uses TLS, the newer replacement.

CT logs (Certificate Transparency logs) — Public, append-only ledgers that record every HTTPS certificate ever issued. Useful for finding all the subdomains of a website, even ones the owner forgot about.