Certificate Transparency Log Monitoring

Every publicly trusted TLS certificate gets logged to a public Certificate Transparency (CT) log the moment it's issued — modern browsers reject any certificate that isn't. A Certificate Transparency monitor watches those logs (via crt.sh, a free public CT search service, with SSLMate's CertSpotter as the fallback when crt.sh is unavailable) for your domain, and tells you the moment a certificate you didn't request shows up — a compromised CA, a social-engineered issuance, or a forgotten subdomain someone else has quietly pointed their own infrastructure at.

Availability

Available on every plan — a single outbound HTTP request per check, nothing like Synthetic Monitoring's browser cost.

How it works

curl -X POST https://api.monsphere.com/api/v1/organizations/{orgId}/monitors \
  -H "X-Api-Key: msph_live_..." -H "Content-Type: application/json" \
  -d '{
    "name": "Example.com CT Log",
    "type": "certificate-transparency",
    "target": "example.com",
    "intervalSeconds": 3600,
    "timeoutSeconds": 30
  }'

Every check searches the CT logs for the domain (and every subdomain of it) and compares the currently valid certificates against what the previous check saw. A certificate that wasn't there before is reported by name — e.g. "1 new certificate(s) detected: www.example.com". Certificates are identified by their names and validity period, so the same certificate counts once (a precertificate and its final certificate included) whichever search answered, and the result says when the fallback was used.

First check never alerts

A monitor's very first check only ever establishes its baseline — the set of certificates that already exist gets recorded, not flagged. Only a certificate that appears on a later check, genuinely new relative to what was already known, is ever reported. A certificate never "disappearing" from a CT log (logs are append-only by design) means there's no equivalent false-alarm risk on the other side either.

This ships with a zero-config default alert — "New Certificate Detected" — the moment one is found, no rule setup required, the same convention the built-in "Monitor Down" alert already uses.

How it runs

Like WHOIS and DNSBL, a Certificate Transparency monitor doesn't go through Blackbox Exporter or Prometheus — there's no CT-log prober in that pipeline. It runs on MonSPHERE's own internal scheduler, so there's no region to pick. If neither CT search is reachable, the check can't run and the monitor reports it — the next check retries.