Certificate Transparency Monitoring

What it checks

Certificate Transparency (CT) monitoring watches the public CT logs for new certificates issued for your domain. Every certificate a public CA issues is recorded in these append-only logs; Merlonix reads them on your cadence and compares the current set against a baseline of certificates it has already seen for your asset. This is different from SSL-expiry monitoring — it is not about your certificate running out, it is about someone (or some system) obtaining a certificate for your name.

Why it matters

An unexpected certificate for your domain can be the first visible sign of a mis-issued, phishing, or shadow certificate — a sign that someone is preparing to impersonate you, or that a team stood up a service you did not know about. CT logs make these public within minutes, and this monitor turns that firehose into a signal about your names specifically.

When it alerts

• First poll (silent seed): the very first check records the certificates already visible for your domain as the known-good baseline and does not alert — otherwise every existing certificate would page you at once.
• New certificate observed (warning): after the baseline exists, each new, previously-unseen certificate raises one warning alert naming the issuer and the hostnames it covers. If you or your provider requested it, no action is needed. If you did not, investigate the issuing CA and, if it is unauthorized, request revocation and review your CA account and CAA records.

A partial or failed read of the CT logs is recorded as unknown and never alerts, so a transient log-provider blip is never misread as a new issuance.

Turning it on

Enable Certificate Transparency monitoring on a domain asset. To see what CT logs currently show for any hostname with no signup, use the free certificate-watch tool on the marketing site. See the Billing page for plan coverage.