Certificate Transparency monitoring

CertObserver can alert you when new SSL/TLS certificates are issued for your domains or their subdomains.

To monitor the certificates your hosts actually use, with automatic host discovery and expiration warnings, see SSL/TLS certificate monitoring.

Monitoring certificate issuance

All publicly trusted SSL/TLS server certificates are logged to public Certificate Transparency (CT) logs. CertObserver monitors those logs for new certificates issued for your domains or their subdomains.

CT monitoring can be used, for example, to:

  • Watch for certificates that may have been issued without your authorization.
  • Discover certificates for new hosts set up by other teams or service providers.

The following alert conditions are available:

  • Every new certificate.
  • A certificate for a DNS name with no other unexpired certificate.
  • A certificate for a DNS name that already has unexpired certificates, but none from the new certificate’s issuer organization.
  • A certificate from an issuer organization with no other unexpired certificates for the monitored domain.

You can choose a severity for each enabled condition. If a certificate matches several enabled conditions, the alert uses the highest severity. Alerts can be sent via email, Slack, or both, and you can choose different destinations based on severity.

You can exclude specific subdomains and monitor certificate issuance for a single host.

How quickly will I be alerted about a new certificate?

Alerts are normally sent within 10 minutes of a certificate being issued. See the monitored CT logs page for current processing status.

Will I get multiple alerts for the same certificate?

A certificate can appear in multiple CT logs, as a precertificate, a final certificate, or both. CertObserver deduplicates these entries, so they don’t trigger separate alerts.