Notifications
Clear all
Topic starter
25/06/2026 10:35 pm
TL;DR: Google’s decision to require Certificate Transparency for publicly trusted SSL/TLS certificates issued from April 2018 affects DV, OV, and EV certificates alike, improving early detection of misissued certificates while forcing certificate teams to adapt workflows, according to DigiCert. The shift makes certificate visibility and lifecycle controls a governance issue, not just a PKI operational detail.
NHIMG editorial — based on content published by DigiCert: Google CT to Expand to All Certificates Types
By the numbers:
- Since January 2015, Chrome has required Extended Validation certificates to comply with Certificate Transparency.
- all publicly trusted SSL/TLS certificates issued in April 2018 or later will be expected to comply with Chrome’s Certificate Transparency policy
- DigiCert began logging all EV certificates ahead of the January 2015 deadline
Questions worth separating out
Q: How should security teams prepare for Certificate Transparency across public certificates?
A: Security teams should first inventory all publicly trusted certificates, then confirm that issuance workflows, defaults, and monitoring can enforce CT across DV, OV, and EV types.
Q: Why do public certificates need transparency controls at all?
A: Public certificates need transparency because misissuance is hard to detect when issuance happens in opaque CA systems.
Q: What operational failures do certificate teams make when CT becomes mandatory?
A: Teams usually fail in three places: they assume only EV certificates are affected, they leave default settings unchanged, or they discover too late that renewal and testing workflows do not support log enforcement.
Practitioner guidance
- Verify CT readiness across all public certificate types Confirm that issuance workflows can handle DV, OV, and EV logging requirements before policy deadlines take effect.
- Inventory public certificates and ownership paths Map which teams own issuance, renewal, and monitoring for public TLS certificates so CT enforcement does not fail at handoff points.
- Review certificate metadata for avoidable disclosure Assess whether certificate naming, subject fields, or SAN entries reveal internal structure, project names, or personal data that should be redacted or minimised before public issuance.
What's in the full article
DigiCert's full blog covers the operational detail this post intentionally leaves for the source:
- Opt-in and defaulting steps for enabling CT in administrator accounts
- Practical guidance on testing OV certificates before broad CT enforcement
- Operational considerations for turning CT on by default across certificate workflows
- The article's discussion of name redaction, privacy, and business disclosure trade-offs
👉 Read DigiCert’s analysis of Google’s Certificate Transparency expansion →
Certificate Transparency for all certs: what IAM teams need to know?
Explore further
25/06/2026 11:11 pm
Certificate Transparency is becoming a lifecycle control, not just a browser requirement. Once CT applies to DV, OV, and EV certificates, the governance problem moves from a narrow CA compliance check to a broader certificate lifecycle obligation. That changes how teams think about issuance readiness, test coverage, and default policy enforcement. Practitioners should treat CT as part of certificate governance architecture, not as an isolated browser compatibility issue.
A few things that frame the scale:
- 66% say their current tooling is not adequate to manage the scale of machine identities they now have, according to The Critical Gaps in Machine Identity Management report.
- Only 38% have automated certificate lifecycle management in place, according to SailPoint research on machine identity management.
A question worth separating out:
Q: Who should own certificate transparency governance in an organisation?
A: Ownership should sit with the team that controls certificate lifecycle management, with clear input from security architecture and compliance. If responsibility is split without a single accountable owner, CT becomes a policy nobody tests and nobody monitors, which defeats the point of the control.
👉 Read our full editorial: Google CT expansion raises the bar for certificate governance
