Certificate Transparency Log Lab

A free, in-browser exercise that puts you in a CT monitoring seat. You are shown a company’s baseline (its domains, the certificate authorities it uses, and the third-party vendors authorized to issue certificates on its behalf) and a feed of Certificate Transparency log entries. For each entry — issuer CA, subject and SANs, validity dates, serial, log and SCT timestamp — you decide whether it is a legitimate certificate or a rogue / mis-issued one, and you are scored on catching the rogues without raising false alarms.

A certificate issued by a CA the organisation never uses (classic mis-issuance for a domain you own), a cert for a subdomain the org never stood up, a look-alike or typosquat domain (a homoglyph, a dropped letter, a hyphen or a swapped TLD that a phisher got a cert for), an unauthorized wildcard that covers every host at once, and a certificate with an oddly early or backdated validity window. It also includes benign-but-surprising entries — a CDN or email vendor legitimately issuing through an unfamiliar CA — as deliberate false-positive traps.

The public key infrastructure will issue a technically valid certificate to anyone who can demonstrate control of a name — including an attacker who typosquats your brand or mis-issues against a domain you own. Nothing in the PKI stops that. Certificate Transparency requires CAs to log every certificate to public, append-only logs, so defenders can monitor those logs and spot mis-issuance and impersonation that would otherwise be invisible until the phishing email lands. This lab drills exactly that review.

No. The company baselines and log entries are invented for training, modelled on the shape of real Certificate Transparency data (issuer CAs, SANs, SCT timestamps, log names). No real company, domain or certificate is depicted, and all date reasoning is relative to a fixed in-lab snapshot date. No account or install is needed.