certspotter

> 1. Is this proactively monitored for? And how? And by whom? Yes, security researchers like myself are constantly looking in CT logs for suspicious certificates, and I've found many, most notably Symantec issuing certs for example.com (https://groups.google.com/g/mozilla.dev.security.policy/c/fy...) and Certinomis issuing for test.com (https://bugzilla.mozilla.org/show_bug.cgi?id=1496088). Both CAs were eventually distrusted. (But Certinomis will be back once eIDAS is adopted!) Domain owners can use Certificate Transparency Monitors to learn about suspicious certificates for their own domains. Here are some monitors: https://crt.sh/ - allows you to search for certificates for a domain https://github.com/SSLMate/certspotter/ - open source tool which notifies you when a certificate is issued for one of your domains https://sslmate.com/ce

Indeed, a CT monitor which sends alerts about legitimate certificates is almost useless due to noise. My service, Cert Spotter, provides an API endpoint[1] which you can upload your CSRs to, so you don't get alerted about certificates using the same key as the CSR. The open source version of Cert Spotter can invoke a script[2] when a certificate is discovered, and the script can cross reference against a list of legitimate certs. [1] https://sslmate.com/help/reference/certspotter_authorization... [2] https://github.com/SSLMate/certspotter/blob/master/man/certs...