Certificate Transparency: Catching Forged Certificates

Log Traffic

Issuance rate 2.0 certs/s

Forged / mis-issued rate 12%

Monitor scan interval 2.0 s

Live Stats

Certs logged

Epochs sealed

Forged detected

0 / 0

Mean time-to-detect

—

Waiting for the first certificate…

Legitimate certificate leaf Forged leaf, undetected Forged leaf, caught by a monitor Internal Merkle node

How it works

A Certificate Transparency (CT) log is an append-only Merkle hash tree. Every issued TLS certificate becomes a leaf; the log periodically hashes leaves in pairs, up to a single 32-byte Merkle root, and publishes a Signed Tree Head. Any client can request a compact audit proof that a specific certificate is included, without downloading the whole log:

root  = H(H(H(L0,L1), H(L2,L3)), …)
proof length ≈ log2(N)   for N leaves
tampering any leaf changes every hash above it → root mismatch

This simulation logs one certificate every 1 / issuance-rate seconds into a 16-leaf window. When the window fills, the tree above it is sealed (flashes gold) and a fresh window starts — exactly like a real log rolling over a batch of entries.

Forged / mis-issued rate — the chance a newly logged certificate was never requested by the domain owner (a compromised CA, a stolen intermediate key, or a fraudulently issued cert).
CT Monitoring — domain owners and browsers run monitors that continuously diff the public log against their own inventory of certs they actually requested. A scan (the pulse ring) catches every still-undetected forged leaf and flips it gold.
Mean time-to-detect — the average gap between a forged certificate being logged and a monitor catching it; it falls as the scan interval shrinks, and stays "—" forever with monitoring off, which is the whole point: an unmonitored log gives an attacker unlimited time on a mis-issued cert.

Real deployments: Google's Certificate Transparency, RFC 6962; Chrome and Safari refuse to trust a publicly-issued certificate that isn't logged this way.

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.