What it is
You declare the domains you own and the certificate authorities you have authorised to issue for them. TigerTrust pulls new entries from CT logs daily, matches them against your domain list, and compares each match against your CA allow-list and policy rules. Certificates that pass every check are added to a discovery index. Certificates that fail any check are surfaced as mis-issuances for your review.When to use it
- Detect certificates issued by CAs you did not authorise — compromised CA, weak domain control validation, or a vendor acting outside scope.
- Catch shadow-IT provisioning where a team obtained a public certificate without going through your PKI process.
- Build a historical index of every public certificate ever issued for your domains, useful during incident response.
- Collect evidence for a CA/Browser Forum mis-issuance report if you need to escalate to the issuing CA.
Set it up
Add your domains
Go to CT Monitoring > Domains and click Add domain. Enter each apex domain or subdomain pattern you want to watch. TigerTrust will match any CN or SAN that falls under the declared domains.
Configure your CA allow-list
Go to CT Monitoring > Allowed CAs and add the certificate authorities you have authorised to issue for your domains. Any CT entry from an issuer not on this list is flagged as a high-severity mis-issuance.
Review active monitors
Go to CT Monitoring > Monitors. TigerTrust ships with a default set of well-known public CT logs. Click Add monitor to add any RFC 6962-compliant log by URL and public key. Common logs include:
Toggle any monitor off to pause it without removing it.
| Log | Operator |
|---|---|
| Google Argon (yearly) | |
| Google Xenon (yearly) | |
| Cloudflare Nimbus | Cloudflare |
| Sectigo Sabre | Sectigo |
| crt.sh aggregator | Sectigo (aggregated) |
What you’ll see
CT Monitoring > Dashboard shows a summary: active monitors, certificates discovered today, and open mis-issuances by severity. CT Monitoring > Discoveries is a searchable index of every CT entry that matched your domains. Filter by issuer, domain, or date range. Even entries that pass every rule appear here as a historical record. CT Monitoring > Mis-issuances lists all flagged entries. Each mis-issuance shows the rule it violated, the certificate details, and its current status.Mis-issuance detection rules
| Rule | Severity |
|---|---|
| Issuer is not in your CA allow-list | High |
| Domain is not in your declared domain list | High |
| Certificate exists in CT but not in your inventory | Medium |
| Validity period exceeds policy limit | Medium |
| Weak signature algorithm (SHA-1) | Critical |
| Wildcard where wildcards are prohibited by policy | High |
Responding to a mis-issuance
Open a mis-issuance record and choose one of three actions:- Acknowledge - Record that you have reviewed it and consider it legitimate (for example, a vendor certificate you were not aware of). Add a note with the justification.
- Resolve - Mark it closed after you have confirmed the certificate has been revoked or expired.
- Report to CA - Generate a formal mis-issuance report bundling the CT entry, the rule violation, and your contact information. Use this to file a complaint with the issuing CA’s abuse or incident-response contact. TigerTrust records the report and tracks the CA’s response.
TigerTrust scans CT logs every 24 hours. New log entries take several hours to propagate across log operators, so a daily cadence captures all entries without unnecessary overhead.
Related
Alerts
Configure alert rules to fire on mis-issuance events.
Certificate inventory
Import CT discoveries into your managed inventory.
Audit logs
Every CT rule change and mis-issuance decision is recorded.