Certificate Transparency is a system of public logs recording TLS certificates as they are issued, so anyone can see certificates created for any domain.
Certificate Transparency (CT) is an open framework of public, append-only logs that record TLS certificates issued by certificate authorities. It was designed to expose mistakenly or maliciously issued certificates, and it has become a valuable early-warning source for brands: when someone gets a certificate for a domain that imitates yours, it usually appears in the logs.
How it works
CT was originally specified in RFC 6962. When a publicly trusted certificate authority issues a certificate, it submits it to several independent CT logs and receives signed proofs that are embedded in the certificate. Major browsers, including Chrome and Safari, expect publicly trusted certificates to carry this proof. Because the logs are public, anyone can search or monitor them:
- search tools such as crt.sh let you look up certificates by domain name;
- monitoring services follow new log entries and alert on names that match patterns you define.
Most phishing sites use HTTPS because free certificates are easy to get, so their certificates are logged too, often before the first phishing message is sent.
Example
As an illustration, a monitoring rule watches for new certificates containing the word "examplebank". One morning, a certificate is logged for examplebank-secure-login[.]com and its subdomain www. The site has no content yet, but the brand now knows the name, can check it regularly and is ready to act as soon as a phishing page goes live.
How to spot it
Signs in CT data that deserve a closer look:
- certificates for domains that combine your brand with words like "login", "secure" or "verify";
- certificates for lookalike domains and punycode versions of your name;
- certificates for subdomains of free hosting or dynamic DNS services that include your brand;
- a sudden burst of related certificates issued within a short time.
What brands can do
Set up CT monitoring for your brand names, common misspellings and key product names, and combine it with newly registered domain feeds. Triage matches quickly: many will be harmless, but the risky ones should be watched until they are confirmed or ruled out. Also check CT for certificates on your own domains that you did not request. Phishvoid uses CT monitoring as one of its detection sources; contact us if you would like it watching your brand.
Read more: Typosquatting and Homoglyph Domains Explained
Seeing this against your brand?
We find and take down phishing and impersonation sites. Tell us what you are seeing.