I’m experimenting with scanning certificate transparency logs for my domains, and I’d like to filter out log entries for legitimately issued certificates so I only get alerts when someone else gets ahold of a certificate for my domain.
I tried to find out if a CT log entry was mine by comparing its fingerprint to the fingerprint of the certificate on my server. However, I found that some of the entries in the log are “pre-certificates,” which have an extra critical extension to make them not valid in browsers. These are apparently considered equivalent to the final issued certificate for transparency purposes (so it seems like a bad idea to just ignore all pre-certificates), but their fingerprint doesn’t match the key that I have.
How can I determine that such a pre-certificate is equivalent to an issued certificate?