📜

Certificate Transparency (CT Logs)

Medium

Free preview · 2 of 5 steps

The problem: undetectable certificate fraud

Any Certificate Authority in the browser's trust store can issue a certificate for any domain. Before CT, a rogue CA (or a compromised CA) could issue google.com certificates for surveillance — and nobody would know.

Certificate Transparency solves this by requiring CAs to publicly log every certificate they issue. If a cert isn't in the log, browsers reject it. If a rogue cert is logged, monitors detect it.

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step