Before Certificate Transparency, a mis-issued certificate was invisible until someone tripped over it. CT made issuance public: every certificate a trusted CA signs lands in append-only, cryptographically verifiable logs that anyone can monitor.
How the logs work
A CT log is a Merkle tree. Submitting a certificate returns a Signed Certificate Timestamp — the log’s promise to include it. Browsers require SCTs from independent logs before trusting a certificate, and auditors can verify inclusion proofs against the tree head.
Why browsers made it mandatory
CT does not prevent misissuance; it makes it undeniable. The DigiNotar-class incident — a CA silently issuing for domains it never should have — is now detectable by the domain owner the same day, because the certificate must appear in a public log to be trusted at all.
Monitoring your own domains
Every operator should watch CT for their namespaces: a certificate you did not request is either a compromised account, a rogue reseller, or an attack in progress. Log monitors and streaming APIs make this a small script, not a project.