Security & SEO

    Certificate Transparency Monitoring

    Monitor SSL certificate issuance and detect unauthorized certificates.

    Updated 2026-03-17
    2 min read
    certificate transparency
    CT logs
    SSL

    Certificate Transparency Monitoring#

    Certificate Transparency (CT) logs are a public record of every SSL certificate issued for your domain. LemWatch monitors these logs to detect unauthorized certificate issuance.

    Why It Matters#

  1. Detect unauthorized certificates — If someone obtains a certificate for your domain without your knowledge, it could indicate a security breach or phishing attempt
  2. Subdomain discovery — CT logs reveal all subdomains that have certificates, including ones you might have forgotten about
  3. Issuer tracking — See which Certificate Authorities (CAs) have issued certificates for your domain

    4. What You'll See#

  4. Total certificates found — How many certificates exist for your domain in CT logs
  5. Certificate issuers — Which CAs issued the certificates (Let's Encrypt, Cloudflare, DigiCert, etc.)
  6. Subdomains discovered — All subdomains with certificates
  7. Expired certificates — Certificates that have passed their validity period
  8. Wildcard certificates — Certificates covering *.yourdomain.com
  9. New certificates since last check — Alerts on newly issued certificates

    10. Alerts#

    LemWatch alerts you when:

  10. A new certificate is issued for your domain by an unexpected CA
  11. A certificate is issued for a subdomain you don't recognise
  12. The total number of certificates changes unexpectedly

    13. Limitations#

    CT log monitoring is passive — it detects certificates after they're issued, not before. For proactive protection, combine with CAA DNS records that restrict which CAs can issue certificates for your domain.

    Was this article helpful?

    Previous

    Malware & Threat Detection

    Next

    Exposed Services & Port Scanning

    Related Articles

    SSL Certificate Monitoring

    Track SSL certificate validity, expiry dates, and chain issues. Get warned 30, 14, and 7 days before certificates expire.

    Domain & WHOIS Monitoring

    Monitor domain registration, expiry dates, and WHOIS changes.

    Understanding Your Security Grade

    How LemWatch calculates your overall security grade.

    Robots.txt check

    Fetches robots.txt hourly and alerts on syntax errors, disallowed indexable paths, or blocked search-engine bots.

    Back to Help Center