What is Certificate Transparency?

Browsers require publicly trusted certificates to appear in Certificate Transparency (CT) logs, so anyone can search them for the hostnames a certificate names. That makes misissued certificates detectable, and it also makes new hostnames public.

Scanners watch the logs: a peer-reviewed study measured first requests arriving on average 5.9 minutes after a certificate was registered. A wildcard certificate, which covers every subdomain of a domain, records only the wildcard name, not each subdomain.