I have an Amazon-issued certificate (via AWS Certificate Manager) for a number of subdomains (CN = *.aws.jamymahabier.nl). However, it is not showing up in the logs at crt.sh (only the Let's Encrypt-issued certificate for my main domain, jamymahabier.nl, is).

Why is this the case? Shouldn't all certificates show up in the CT logs?

  • This doesn't appear to be an InfoSec related question, within the scope defined, and might be more suited on another stack exchange site. – ISMSDEV Nov 6 '17 at 9:06
  • 3
    I think this question is relevant and interesting – paj28 Nov 6 '17 at 9:25

Without seeing the exact certificate its not possible to check that there definitely isn't transparency for that certificate - there are numerous logs and I do not know which crt.sh searches.

However CT is still optional and most clients do not enforce it yet. Chrome requires it for EV certificates and all certificates issued by Symantec after 1st June 2016 - so it is possible Amazon have chosen not yet to implement it for AWS Certificate Manager.

*https://transparencyreport.google.com/https/certificates does not show the certificate - which suggests to me Amazon have chosen not to implement it.


crt.sh needs a more specific query to find your domain, although it does look like it took a few months before the cert was logged. Facebook also provides a Certificate Transparency Monitoring tool, it does a better job searching by domain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.