Report2026-08-15•5 min read

Certificate Transparency Growth Report 2026

· CSR.plus Team

•CT logs have grown into the largest public ledger of issuance events on the internet, with billions of entries and continuous growth.
•For domain owners, CT is a free early-warning system: search your domain to spot certificates you did not request.
•Issuance trends visible in CT show the continued dominance of short-lived automated certificates.

Billions

Log entries

across major CT logs

Browsers

SCT requirement

certs must include SCTs

Domain owners

spot unauthorized issuance

Automation

Trend

short-lived + ACME dominant

What CT is and why it exists

Certificate Transparency is a set of public, append-only logs that record every publicly trusted certificate. Browsers require newly issued certificates to carry Signed Certificate Timestamps (SCTs) from these logs, which makes issuance events public and auditable. This is what prevents a CA from quietly issuing a certificate for a domain you own.

What the 2026 data shows

Log growth tracks issuance volume, and issuance is dominated by short-lived, automated certificates — the majority issued by Let’s Encrypt with 90-day lifetimes. Wildcard issuance continues to rise with the growth of managed platforms. Monitoring issuance volume per domain is a useful proxy for ecosystem activity and a practical security signal for high-value domains.

How domain owners use CT

Search the logs for your domain (this site’s CT tool queries crt.sh and Cert Spotter). Review every result: legitimate certificates from your providers, then any entry you did not request — a sign of unauthorized issuance attempts or a compromised account. Set up daily monitoring for high-value domains; CT is free, immediate and public.

FAQ

Can certificates be hidden from CT?

No public browser-trusted certificate can be issued without SCTs. Some CAs offer logging-delayed or private issuance for special cases, but they do not work in normal browsers.

How often should I check my domain?

High-value domains should be monitored continuously (daily log search). Everyone else should check after any account or server compromise and after domain transfers.

UptimeRobot