Topic starter
12/07/2026 12:14 pm
TL;DR: Certificate Transparency makes certificate issuance publicly auditable, which helps domain owners and CAs spot misissued SSL/TLS certificates faster and meet browser policy requirements, according to GlobalSign. Certificate logs, SCT validation, and revocation ownership now belong in machine identity governance, not just PKI administration.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Qué es Certificate Transparency”.
Key questions
Q: Why do misissued certificates create risk even when the underlying cryptography is strong?
A: A misissued certificate can still authenticate a service if browsers or clients trust it, which means the attack is about misplaced trust rather than broken encryption.
Q: What are the signs that certificate governance is failing in critical infrastructure?
A: Common warning signs include unclear ownership, expired certificates, mixed use of approved and unapproved issuers, and last-minute manual renewals.
Q: Why does certificate transparency create governance risk for certificate teams?
A: Because CT turns certificate issuance into an observable event that must be explained, logged, and reviewed consistently.
Practitioner guidance
- Monitor CT logs for unexpected issuance Set up continuous monitoring of Certificate Transparency logs for your domains, including lookalike names and unexpected subdomains, so you can detect misissued certificates before they persist.
- Embed SCT checks into issuance workflows Require signed certificate timestamps to be present before a certificate is promoted into production, whether delivery is through the certificate itself, TLS extension, or OCSP stapling.
- Assign clear certificate ownership Map certificate ownership to the teams responsible for renewal, revocation, and incident response so misissuance does not sit between PKI, platform, and IAM functions.
Bottom line: Certificate Transparency changes SSL governance by making certificate issuance auditable and easier to challenge when something looks wrong.
Glossary terms: Certificate Transparency, Signed Certificate Timestamp, Precertificate, Certificate Revocation List
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 53 minutes ago by NHI Mgmt Group
12/07/2026 12:28 pm
Certificate issuance has become a trust-control problem, not a pure PKI problem. CT moves certificate governance from a closed operational process into a public accountability model. That matters because trust now depends on visible issuance, not just on cryptographic validity. Practitioners should treat certificate logs as part of identity governance for machine credentials.
A question worth separating out:
Q: What happens when browser trust requirements change faster than certificate processes?
A: Organisations end up with certificates that are technically valid but operationally untrusted because their issuance path does not satisfy current browser policy. The consequence is failed deployments, emergency replacements, and fragmented ownership between infrastructure teams and identity governance. The safer model is to treat browser policy as a standing control requirement.
👉 Read our full editorial: Certificate Transparency is becoming a trust control for SSL governance