A CA submits a precertificate to several logs, receives signed certificate timestamps (SCTs) promising inclusion within the maximum merge delay (24 hours) and embeds them in the final certificate. Browsers enforce CT policies: Chrome and Apple require SCTs from at least two distinct log operators, with two SCTs for certificates valid up to 180 days and three for longer ones (Apple counts at most one or two per operator). Firefox has enforced CT on desktop since version 135.
Logs are operated by Google, Cloudflare, DigiCert, Sectigo, Let's Encrypt and others. Clients can verify inclusion and consistency proofs; in practice monitors (crt.sh, Cert Spotter, Facebook's CT monitoring) watch logs and alert domain owners. RFC 9162 (CT 2.0) and the tiled static-ct-api, accepted by Chrome since 2025, modernize the design.
Side effect: every host name in a public certificate becomes public within minutes, so internal names leak and attackers watch logs for new sites. The CT history tool lists certificates logged for a domain.