Topic starter
24/10/2026 8:49 pm
TL;DR: Certificate transparency still leaves visibility gaps for non-browser clients, Red Sift argues, because enforcement depends on client behaviour rather than the CA and Browser Forum baseline. Misissued certificates can stay hidden unless teams watch CT logs and act on what appears there.
Editorial analysis by NHI Mgmt Group, based on content published by Red Sift: “The Certificate Transparency Visibility Gap”.
Key questions
Q: Why does certificate transparency still need monitoring if it already logs certificates?
A: Because logging creates visibility, not response.
Q: How should teams reduce certificate issuance risk in public PKI?
A: Use CAA to restrict which certificate authorities are permitted to issue for your domains, and pair that with CT monitoring to detect anything that still slips through.
Q: What breaks when certificate transparency is not enforced for a domain?
A: Without Certificate Transparency, a domain owner can miss misissued or unauthorised certificates until they appear in production, which increases the window for impersonation or interception.
Practitioner guidance
- Audit client-side CT enforcement Identify which browsers, SDKs, TLS libraries, and service-to-service clients actually enforce certificate transparency, then mark every non-enforcing path as a blind spot.
- Monitor CT logs for your properties Set up continuous alerting for unexpected certificates issued to your domains, subdomains, and IP addresses, with a clear escalation path for misissuance.
- Publish restrictive CAA records Use CAA to limit issuance to trusted certificate authorities and, where appropriate, specific CA accounts so unauthorised issuance paths are reduced.
Bottom line: Certificate transparency is useful, but it is not a universal safeguard because many clients do not enforce it outside browser environments.
Glossary terms: Certificate Transparency, CAA, Internal PKI, Misissuance
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:12 am
CT visibility is not equivalent to CT control: the industry often treats certificate transparency as a universal safeguard, but enforcement is fragmented across clients and protocols. Browser ecosystems get the strongest protection, while API traffic and server-to-server TLS frequently do not. The practical conclusion is that public PKI governance still depends on where enforcement actually exists, not where policy language says it should.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: What is the difference between CT and CAA in certificate governance?
A: CT is a visibility control that makes issuance public and searchable, while CAA is an authorisation control that limits who may issue in the first place. They solve different governance problems, and organisations need both if they want to reduce unauthorised issuance and detect the cases that still occur.
👉 Read our full editorial: Certificate transparency gaps still leave public PKI issuance exposed
This post was modified 6 days ago by NHI Mgmt Group