What certificate transparency logs leak
Certificate transparency solved a real problem and created a smaller one in the process. Every certificate issued for a publicly trusted CA lands in a log that anyone can query, forever. That is the point. It also means the log is an inventory of your infrastructure, updated in near real time.
The things people forget: the set of names reveals internal naming conventions; issuance timestamps reveal how often you deploy; and a burst of reissuance at an odd hour is a fairly good signal that something went wrong.
If you run internal services, put them under a name that is not guessable and do not issue public certificates for them. If you must, accept that the name is public the moment the certificate is signed.
← All notes