SCTs

SCTs, or Signed Certificate Timestamps, are cryptographically signed statements that a Certificate Transparency log has observed a particular digital certificate. They are part of the Certificate Transparency initiative, which aims to improve the accountability of TLS certificate issuance by making certificates publicly auditable. An SCT serves as verifiable proof that the certificate was logged in a public transparency log.

Each SCT contains information that allows a verifier to confirm its validity. Typical components include a reference to the log that issued the timestamp (log_id), a timestamp indicating when the certificate was logged, and a digital signature produced by the log over the structured data. A certificate may carry one or more SCTs, originating from different CT logs, to improve trust and redundancy. The data may also include an extensions field that can carry additional information.

SCTs can be delivered to clients in several ways. They can be embedded directly in the certificate as an X.509 extension, included in a TLS handshake via a TLS extension that carries a list of SCTs, or supplied through an OCSP response (OCSP stapling). In practice, browsers and other TLS clients check SCTs against the public CT logs to determine whether the certificate has been logged and, by extension, whether it meets CT requirements of the issuing CA or policy in use.

While SCTs increase transparency and detect misissuance, they do not by themselves guarantee trust. Verification depends on the set of trusted CT logs, the integrity of those logs, and policy rules implemented by software and operators.