Topic starter
12/07/2026 12:14 pm
TL;DR: Certificate Transparency turns certificate issuance into a public, auditable record, allowing domain owners and CAs to detect misissued SSL/TLS certificates faster and meet browser policy requirements, according to GlobalSign. For identity and access teams, the shift matters because certificate governance is part of non-human identity control, not just PKI administration.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Qué es Certificate Transparency”.
Key questions
Q: Why does certificate transparency create governance risk for certificate teams?
A: Because CT turns certificate issuance into an observable event that must be explained, logged, and reviewed consistently.
Q: Why do misissued certificates create risk even when the underlying cryptography is strong?
A: A misissued certificate can still authenticate a service if browsers or clients trust it, which means the attack is about misplaced trust rather than broken encryption.
Q: What are the signs that certificate governance is failing in critical infrastructure?
A: Common warning signs include unclear ownership, expired certificates, mixed use of approved and unapproved issuers, and last-minute manual renewals.
Practitioner guidance
- Monitor CT logs for unexpected issuance Set up continuous monitoring of Certificate Transparency logs for your domains, including lookalike names and unexpected subdomains, so you can detect misissued certificates before they persist.
- Embed SCT checks into issuance workflows Require signed certificate timestamps to be present before a certificate is promoted into production, whether delivery is through the certificate itself, TLS extension, or OCSP stapling.
- Assign clear certificate ownership Map certificate ownership to the teams responsible for renewal, revocation, and incident response so misissuance does not sit between PKI, platform, and IAM functions.
Bottom line: Certificate Transparency changes SSL governance by making certificate issuance auditable and easier to challenge when something looks wrong.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:28 pm
Certificate issuance has become a trust-control problem, not a pure PKI problem. CT moves certificate governance from a closed operational process into a public accountability model. That matters because trust now depends on visible issuance, not just on cryptographic validity. Practitioners should treat certificate logs as part of identity governance for machine credentials.
A question worth separating out:
Q: What happens when browser trust requirements change faster than certificate processes?
A: Organisations end up with certificates that are technically valid but operationally untrusted because their issuance path does not satisfy current browser policy. The consequence is failed deployments, emergency replacements, and fragmented ownership between infrastructure teams and identity governance. The safer model is to treat browser policy as a standing control requirement.
👉 Read our full editorial: Certificate Transparency is becoming a trust control for SSL governance