CT log monitoring

Every certificate a browser trusts has to be published in public Certificate Transparency (CT) logs. CertWatchr watches those logs for your hostnames and tells you when a certificate you have not seen before is issued — including one issued by mistake, by another team, or by someone who should not have been able to.

The regular certificate check only sees what your server serves on the port. CT monitoring sees every certificate issued for the name, wherever it ends up.

Availability. On for every domain on Starter and Pro accounts. Nothing to switch on.

What you get

• Once an hour, CertWatchr looks up each of your hostnames in the public logs.
• The first time a certificate is seen, it is recorded. If any new ones appeared since the last look, you get one "new certificate in CT log" alert for the domain, by e-mail and (Pro) by webhook, telling you how many. Several new certificates within a day produce one alert, not several.

Checking whether a new certificate was expected

Open the domain's page. The Certificate Transparency log observations card lists the most recent 25 certificates seen for the hostname: when it was first seen, the issuer, the name, the validity period and the serial number.

A new entry from your own CA around your renewal date is a normal renewal. An entry from a CA you do not use, or at a time you did not renew, is worth investigating — check who in your organisation issued it, and if nobody did, contact the CA.

Limits

• Matching is on the exact hostname you monitor. A certificate for api.example.com does not show up under a monitored example.com; add api.example.com as its own domain to watch it.
• CT logs are looked up through a public service. If it is briefly unavailable, the lookup is retried on the next hour; nothing is lost, only delayed.