Topic starter
24/10/2026 8:49 pm
TL;DR: Certificate transparency still leaves practical visibility gaps because CT is enforced by client behaviour, not the CA/Browser Forum baseline, and many non-browser clients ignore it, according to Red Sift. That means certificate misissuance can remain undetected unless teams monitor logs and use CAA to constrain issuance.
Editorial analysis by NHI Mgmt Group, based on content published by Red Sift: “The Certificate Transparency Visibility Gap”.
Key questions
Q: What breaks when certificate transparency is not enforced for a domain?
A: Without Certificate Transparency, a domain owner can miss misissued or unauthorised certificates until they appear in production, which increases the window for impersonation or interception.
Q: Why does certificate transparency still need monitoring if it already logs certificates?
A: Because logging creates visibility, not response.
Q: How should teams reduce certificate issuance risk in public PKI?
A: Use CAA to restrict which certificate authorities are permitted to issue for your domains, and pair that with CT monitoring to detect anything that still slips through.
Practitioner guidance
- Audit client-side CT enforcement Identify which browsers, SDKs, TLS libraries, and service-to-service clients actually enforce certificate transparency, then mark every non-enforcing path as a blind spot.
- Monitor CT logs for your properties Set up continuous alerting for unexpected certificates issued to your domains, subdomains, and IP addresses, with a clear escalation path for misissuance.
- Publish restrictive CAA records Use CAA to limit issuance to trusted certificate authorities and, where appropriate, specific CA accounts so unauthorised issuance paths are reduced.
Bottom line: Certificate transparency is useful, but it is not a universal safeguard because many clients do not enforce it outside browser environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →