Someone Can Get an SSL Certificate for Your Domain. CT Logs Are How You Find Out.

An unauthorized certificate for your domain never touches your server, so your monitoring never sees it — but it is public in the Certificate Transparency logs. How CT works, how to check crt.sh and certspotter yourself, CAA as prevention, and why catching one means watching for a new issuance.