The Cryptographic Audit Trail
Certificate Transparency (CT) is an open framework designed to monitor and audit the issuance of SSL/TLS certificates. The system mandates that Certificate Authorities (CAs) log every certificate they issue to public, cryptographically verifiable, append-only ledgers.
The Reconnaissance Leak
While CT logs were created to detect rogue or unauthorized certificates (such as an attacker trying to issue a fake certificate for a bank), they also act as a directory of an organization's subdomains.
The moment a developer generates a certificate for a subdomain (e.g., staging-payment.example.com), that record is pushed to public CT logs. Security researchers query these logs via interfaces like crt.sh to map the entire external attack surface.