--- title: "Certificate Transparency: get notified of new certificates · Wi24rd" description: "Turn on Certificate Transparency monitoring and add CAA records to your domain. Free with Cloudflare, about 10 minutes – step by step, and what to do when the email arrives." url: "https://wi24rd.com/en/security-tips/certificate-transparency/" lang: "en" alternates: da: "https://wi24rd.com/sikkerhedstips/certificate-transparency/" en: "https://wi24rd.com/en/security-tips/certificate-transparency/" --- Security tip 2 · Certificate Transparency # Get notified when someone issues a certificate for your domain. Every certificate browsers trust is written to public logs. Let someone read them for you – and decide who may issue them in the first place. Free, and about 10 minutes with Cloudflare. Last checked 1 November 2026 [Go to the steps](https://wi24rd.com/en/security-tips/certificate-transparency/#trin)[See it working on wi24rd.com](https://wi24rd.com/en/security/#segl) Time ~10 min Price Free on every Cloudflare plan Two layers CAA + CT the lock and the alarm Needs Access to your DNS Why ## The padlock can be faked – but not in secret. The certificate is what gives the padlock in the browser. If an attacker gets a valid certificate issued for your domain – through a forgotten DNS record, a taken-over mailbox or a mistake at an issuer – a fake page can look completely real. Since 2018, Chrome and Safari have required certificates to be written to public _Certificate Transparency_ logs, or they will not trust them. So a certificate for your domain cannot be hidden. But someone has to look – and that is what CT monitoring does. _How it works: An issuer creates a certificate for your domain. It is written to a public Certificate Transparency log. The monitor reads the log and sends you an email._ 1. **Issuer**creates a certificate 2. **Public CT log**anyone can read it 3. **Monitor**spots your domain name 4. **Email to you**you check if it is yours **Two layers that work together** **CAA records are the lock.** A small DNS record telling every issuer who may create certificates for your domain. Everyone else must refuse. **CT monitoring is the alarm.** It reads the public logs and writes to you when a certificate with your domain name appears. Step by step · Cloudflare ## Six steps, about 10 minutes. 1. ### Open your domain in Cloudflare Log in to [dash.cloudflare.com](https://dash.cloudflare.com/) and choose the domain you want to protect. 2. ### Go to Edge Certificates In the left menu: **SSL/TLS → Edge Certificates**. Scroll down to the **Certificate Transparency Monitoring** card. 3. ### Switch monitoring on Flip the switch. A yellow notice appears: _Alerts are on but no recipients are enrolled_. It means nothing is sent to anyone yet. 4. ### Add a recipient Enter your email under **Notification email** and press **Add Email**. When it says _Alerts active – 1 recipients_ in green, it works. 5. ### Add the lock: CAA records Go to **DNS → Records → Add record**. Choose the type **CAA**, the name `@` (your domain), the tag _Only allow specific hostnames_ (technically `issue`) and enter the issuer, e.g. `letsencrypt.org`. Save, and repeat with `pki.goog` (Google Trust Services). 6. ### Check the result Run the command below. You will see more issuers than you entered: Cloudflare automatically adds – invisibly in the list – the issuers it uses for your certificates, so they can be renewed. That is expected. Every other issuer is now locked out. ``` dig ditdomaene.dk caa +short ``` On Windows: `nslookup -type=CAA yourdomain.com`. For wi24rd.com it shows five permitted issuers – instead of the hundreds that could otherwise have issued a certificate. When the email arrives ## Every email deserves a look. Cloudflare filters out its own certificates – including the automatic renewals. So when an email arrives, it is a certificate someone else had issued. The email shows the domain, the issuer, the names on the certificate and how long it is valid. 1. ### Did you order it yourself? Or a service you use: email provider, newsletter, web shop, hosting company. Then all is well. 2. ### Do the names fit? Do you know every subdomain on the certificate? An unknown name can be a forgotten DNS record someone has taken over. 3. ### Can nobody explain it? Contact the issuer – only they can revoke the certificate. Change the passwords for DNS and your domain registrar, and turn on two-factor authentication. Without Cloudflare ## It can be done too. - **CAA** can be set at most DNS providers – look for the CAA record type. - **[crt.sh](https://crt.sh/)** is free and shows every certificate in the public logs. Search for `%.yourdomain.com` to see what already exists. It is a snapshot, not an alarm. - **[Cert Spotter](https://sslmate.com/certspotter/)** monitors for you from 15 USD a month with a 30-day free trial. It also exists as a [free open-source program](https://github.com/SSLMate/certspotter) you can run on your own server. CT monitoring does not catch look-alike domains such as `wi24rd-login.com` – only certificates with your own domain name. **About this tip** wi24rd.com uses both layers itself. You can see the CAA records and DNSSEC looked up live under [The seal](https://wi24rd.com/en/security/#segl). The steps were checked in Cloudflare’s dashboard on 1 November 2026, where Certificate Transparency monitoring is available on every plan. Wi24rd has no financial interest in Cloudflare or SSLMate. [All security tips](https://wi24rd.com/en/security-tips/) [Back to Security tips](https://wi24rd.com/en/security-tips/)[To the top](https://wi24rd.com/en/security-tips/certificate-transparency/#top) ## Missing a tip? Write what you would like explained. The next security tip could be yours. [Write to Wi24rd](https://wi24rd.com/en/contact/)[The site’s own defences](https://wi24rd.com/en/security/)