Certificate Transparency watch
How the certificates issued for your domains are read between audits, what makes one unusual, and what to do when you get an alert.
Every certificate issued for your domain and its subdomains is public: certificate authorities write it in the Certificate Transparency logs. Perimetry Cloud reads those logs for each proved domain, between audits, and tells you when a certificate is unusual. It is often the first sign that someone took over a subdomain, or set up a phishing page with your name on it.
How often the logs are read
- up to every hour on the Agency plans;
- every 6 hours on Solo;
- once a day on Free.
The card Certificates issued for this domain, on the domain’s page, says when the logs were last read. If they did not answer, it says so, and they are tried again soon.
The first reading
The first reading is a reference: the certificates already there are recorded without any alert. From then on, only new certificates are judged. A certificate issued more than 14 days before we first see it also joins the reference quietly.
What makes a certificate unusual
A new certificate is flagged, with the reason, when:
- not allowed by CAA: it comes from an authority that your CAA records do not allow (for a wildcard certificate, the
issuewildrecords count); - new authority: it comes from an authority that never issued a certificate for this domain before, and that your CAA records do not explicitly allow;
- new name: it names a host never seen before, neither in an earlier certificate nor among the hosts of the latest audit.
Ordinary renewals stay quiet.
The alert
When unusual certificates are read, one alert goes to every active channel of the domain on the Alerts page (and of its client, on the Agency plans), whatever their rule, without waiting for the next audit. Certificates also appear on the Changes page.
Review a certificate
The card lists the certificates seen, unusual ones first, with their names, the authority, the dates of issue and expiry, and whether an alert was sent. Show Unusual or All.
When an unusual certificate is legitimate (you, or your host, asked for it), press Expected: the card notes who marked it and when. Not reviewed undoes that. Viewers cannot mark certificates.
If a certificate is not yours
Ask the authority that issued it to revoke it. Check your DNS records and who can access your host and registrar accounts. Then add a CAA record that lists only the authorities you use: the DNS record generator builds one, and the CAA finding of your report gives one ready to copy.