A Signed Certificate Timestamp (SCT) is a cryptographically signed promise from a Certificate Transparency (CT) log. When a log accepts a certificate or precertificate, it promises to publish that entry in its append-only log within its declared Maximum Merge Delay (MMD). CT makes publicly trusted TLS certificate issuance visible for browsers, domain owners and independent monitors. An SCT is not proof that the entry has already been included, that anyone has reviewed it, or that a misissued certificate will be revoked.
What is a Signed Certificate Timestamp?
An SCT is a statement signed by a CT log that identifies the log, records a timestamp and commits to adding an accepted certificate or precertificate to that log within the log’s MMD. A Certificate Authority (CA), rather than a normal website visitor, usually submits the certificate material to one or more logs during issuance.
The SCT travels with the certificate or is delivered through another supported mechanism. A client can use it to determine that a recognized log made a time-bounded commitment. The commitment is important, but it is not the same thing as a completed inclusion proof. Later, auditors can verify that the log incorporated the entry and that the log’s published Merkle-tree history remains consistent.
- It is a log commitment: the log promises publication by its MMD.
- It is not a certificate: the CA-issued certificate remains the credential used for TLS.
- It is not an inclusion proof: an SCT alone does not demonstrate that the entry is already in a tree.
- It is not a monitoring result: nothing in the timestamp proves that a person or service checked the log.
- It is not a revocation guarantee: CT exposes issuance; it does not automatically revoke a suspicious certificate.
How does Certificate Transparency work?
CT is a public auditing system for publicly trusted TLS server certificates. Its logs are designed to be append-only and use Merkle-tree structures, allowing independent parties to check both inclusion and consistency.
#1 Best Overall
- Submission: a CA or another authorized submitter sends a certificate or precertificate to a CT log.
- Acceptance: the log validates the submission against its entry rules and, if accepted, returns an SCT.
- Commitment: the SCT binds the log identity, timestamp and signature to the submitted certificate data and states the log’s promise to merge the entry within its MMD.
- Publication: the log incorporates the entry into its append-only Merkle tree before the MMD expires.
- Auditing: monitors and auditors request inclusion proofs and signed tree heads, then compare views over time to detect omissions, equivocation or other log misbehavior.
- Client enforcement: browsers and platforms apply their own rules about how many SCTs are needed, which logs count and which delivery method is acceptable.
These roles are distinct. CAs submit entries, log operators accept and publish them, monitors inspect certificates and log behavior, and clients enforce policy. CT is therefore an observability and accountability layer around certificate issuance, not a replacement for a CA or a browser trust store.
What CT can—and cannot—protect against
What it improves
- Unexpected certificates for your domain become discoverable in public logs.
- Researchers and domain owners can compare log views and identify a log that failed to publish a promised entry or produced inconsistent histories.
- Browsers can require evidence that certificates were logged before accepting them under their platform policy.
What it does not prevent
- A CA can still misissue a certificate; CT does not block issuance at the moment it happens.
- A logged certificate may go unnoticed if nobody monitors the relevant names.
- An SCT does not itself trigger revocation, customer notification or incident response.
- Public logging exposes names covered by certificates. CT is not a method for keeping hostnames confidential.
RFC 9162 and RFC 6962: which version applies?
RFC 9162, published in December 2021, documents Certificate Transparency version 2.0 and obsoletes RFC 6962. RFC 9162 is published as Experimental rather than on the Internet Standards Track. That protocol revision does not mean every browser policy or deployed log has migrated to one uniform rule set.
Chrome and Apple’s published requirements still refer to RFC 6962 compliance in relevant contexts. The practical distinction is:
- Protocol specification: RFC 9162 describes CT 2.0 behavior.
- Deployed policy: a browser or platform decides which protocol features, logs and SCT presentations it accepts.
- Operational decision: use the current policy and log list for the client you must support, rather than assuming that the RFC version alone determines compliance.
How do Apple and Chrome evaluate SCTs?
Apple’s policy
Apple’s Certificate Transparency policy evaluates SCT count, log approval status, delivery method, certificate lifetime and log-operator diversity. For relevant publicly trusted TLS certificates, Apple requires at least two SCTs from logs that were approved at the applicable time, with additional conditions around current approval and presentation. At least one SCT must come from an RFC 6962-compliant log.
| Certificate validity interval | Apple’s published SCT threshold |
|---|---|
| 180 days or less | Two SCTs from distinct logs. |
| 181 to 398 days | Three SCTs from distinct logs, subject to limits on how many SCTs from one log operator count. |
Apple defines the validity interval inclusively and treats a day as 86,400 seconds. These are Apple’s requirements for the certificate categories covered by its policy, not a universal rule for every client or private PKI.
Chrome’s policy
Chrome evaluates the number and source of SCTs together with the state of the issuing logs at the relevant times. Its log states include Pending, Qualified, Usable, ReadOnly, Retired and Rejected. Because Chrome’s policy and log list are maintained documents, check their current versions before making a live issuance or deployment decision.
Rank #3
Does a site owner need to configure CT?
Usually not. A publicly trusted CA normally obtains SCTs during issuance, and a cloud TLS terminator may handle their delivery. Chrome’s site-operator guidance recommends embedding SCTs in the certificate. If Chrome reports that a certificate does not meet a CT requirement, contact the issuing CA’s support or sales team and provide the hostname, certificate chain, browser error and issuance time.
You should still verify what your provider is doing when you change CAs, move TLS termination, renew a long-lived certificate or introduce a new hostname. A provider can change its log set or delivery method even when your web server configuration stays the same.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11How do I check certificates issued for my domain?
Use a one-time CT search to establish a baseline, then add continuous monitoring for names that matter. The exact search interface varies by provider, so review both certificates and precertificates and treat wildcard names as covering their underlying namespace.
Rank #4
- 2-part carbonless unit set
- Consecutive numbering
- Includes Gift Certificates Available sign
- 25 certificates with envelopes per package
- White/canary form sequence
- Inventory names: list every production hostname, wildcard, mail name and service endpoint that could legitimately appear in a certificate. Include old names that may still be valid during a migration.
- Search public CT logs: search each exact domain and its parent-domain view, then export the certificate or precertificate records. Group duplicate observations of the same certificate rather than counting every log copy as a separate issuance.
- Inspect the certificate: compare the subject and Subject Alternative Name list with your inventory, then check issuer, validity interval, key type and issuance time. For a live endpoint, retrieve the served chain with:
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/nullSave the leaf certificate and inspect it with:
openssl x509 -noout -text -in certificate.pem- Classify every result: mark certificates as expected, expired, revoked, an authorized third-party service, or unexplained. A certificate can be legitimate even if it was not issued by your usual provider, for example during a vendor migration.
- Verify with the CA: for an unexplained result, contact the issuing CA through its abuse or support channel. Ask for validation records, issuance details and the status of the certificate.
- Escalate suspected misissuance: remove unauthorized keys and certificates from services, rotate credentials where appropriate, and request revocation. Keep the CT record, CA correspondence and response timeline as incident evidence.
- Automate the baseline: subscribe to a CT monitor that alerts when matching certificates or precertificates appear. Confirm which names, wildcard forms, log sources and notification channels it covers; providers do not all offer the same scope.
Monitoring choices and response workflow
A one-time search is useful after a domain takeover concern, CA migration or inventory project. Ongoing monitoring is better for production domains because it turns a public log into an alerting source. Cloudflare documents an opt-in Certificate Transparency Monitoring feature that alerts when a certificate covering a monitored domain is issued and added to a public log. Community monitor directories also list other services, but a directory listing is not proof that providers have equivalent coverage or response quality.
Regardless of the monitor, define who validates an alert, who contacts the CA, who can revoke a certificate and how quickly DNS, TLS and application credentials can be changed. An alert without an owner is only a notification, not protection.
Privacy, logging and operational trade-offs
Public CT improves accountability by making certificate names searchable. That same visibility means internal naming conventions, staging hostnames and customer-specific names should not be placed in publicly trusted certificates unless you accept their disclosure. Use an internal or private PKI when a name must remain outside public certificate logs, while recognizing that private PKI has a different trust and monitoring model.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Certificate lifetime also affects policy requirements. Shorter certificates can fall into a different Apple SCT category, but changing lifetime does not eliminate the need to monitor issuance or satisfy the client policies your users encounter.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting common CT problems
| Symptom | Likely cause | Action |
|---|---|---|
| Chrome reports a CT-required error. | Missing, insufficient or unacceptable SCTs, or a log that is not in an acceptable state. | Confirm the served certificate and SCT delivery, then ask the CA or TLS provider to diagnose issuance against Chrome’s current policy and log list. |
| Apple clients reject a certificate that Chrome accepts. | Different SCT count, lifetime, operator-diversity or log-approval requirements. | Evaluate the certificate against Apple’s current policy, including the 180-day and 181-to-398-day categories and the RFC 6962-compliant-log condition. |
| A certificate appears in a CT search but is not on your server. | It may be a precertificate, an old deployment, a third-party service, a duplicate log view or unauthorized issuance. | Compare names, issuer and validity dates, check former providers and vendors, and contact the CA if it remains unexplained. |
| An SCT exists but an auditor cannot find the entry. | The log may not have reached its MMD, or the log may have failed to fulfill its commitment. | Record the SCT timestamp and log identity, wait through the declared MMD when appropriate, then request an inclusion proof or escalate suspected log misbehavior. |
| Monitoring produces too many alerts. | Wildcard expansion, duplicate submissions and legitimate vendor certificates are being treated as separate incidents. | Normalize certificates by fingerprint, maintain an allowlist of approved issuers and vendors, and keep an explicit inventory of expected names. |
| A hostname you expected is absent from public CT. | The certificate may be private, not publicly trusted, newly submitted, or outside the search’s name and wildcard scope. | Check the certificate type, search the parent domain and precertificate records, and confirm the monitor’s coverage before concluding that issuance did not occur. |
Or skip the browser setup
ScreenshotNeo is a website screenshot API and MCP server, not a CT log monitor. If you need a clean visual record of a CT search page, policy document or incident ticket, it can capture that webpage without building browser automation. Before capture, it accepts cookie or consent banners and removes more than 60 known consent platforms, newsletter popups and chat widgets; bot checks, blank pages, timeouts, failed loads and cache hits are not billed, and response headers identify the page verdict and billing status. Its MCP server lets Claude, Cursor and other MCP clients use take_screenshot, get_page_info and capture_pdf.
See the ScreenshotNeo documentation for authentication and options. A one-call capture looks like this:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpPython:
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)Node.js:
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);ScreenshotNeo includes full-page capture, CSS-selector element capture, custom waits, headers and cookies, device and viewport controls, PDF output, signed links, asynchronous jobs and bulk capture. The Free plan includes 1,000 screenshots each month without a card; paid plans start at $5 for 3,000 shots. If you want those clean evidence captures, create a free ScreenshotNeo account.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Frequently Asked Questions
Does Certificate Transparency cover certificates from a private enterprise CA?
CT is defined around publicly trusted TLS server certificates. A private enterprise CA normally follows its own logging and audit arrangements, so do not assume that a public CT search contains its certificates.
Can a domain owner hide a name after a certificate has been publicly logged?
No. CT logs are designed to be append-only. You can replace or revoke the certificate, but the historical log entry remains part of the public audit record.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
