miji.beCertificate Transparency (CT) is an open framework for monitoring and auditing the issuance of SSL/TLS certificates. It requires Certificate Authorities to publicly log every certificate they issue, creating an auditable record that allows domain owners and security researchers to detect misissued or fraudulent certificates.
The CT system works through append-only logs maintained by independent operators. When a CA issues a certificate, it submits the certificate to one or more CT logs and receives a Signed Certificate Timestamp (SCT) as proof of submission. Browsers like Chrome require SCTs for certificates to be trusted, ensuring that all certificates are publicly logged.
For URL shortening services, Certificate Transparency provides a way to monitor whether unauthorized certificates have been issued for their domains. If an attacker obtains a fraudulent certificate for the shortening service's domain, CT logs would reveal the issuance, allowing the service to take action before the certificate is used in an attack.
Domain owners can use CT monitoring services to receive alerts when new certificates are issued for their domains. This is particularly important for services that handle sensitive data or serve as trust intermediaries, as URL shortening services do.