DigiCert CT Logging Changes June 2026: What SSL Certificate Owners Need to Know

Key Takeaways

DigiCert is enforcing Certificate Transparency (CT) logging for all public trusted TLS/SSL certificates as of June 1, 2026; this includes the logging of test and canary certificates (DV, OV, EV), and wildcard certificates. This compliance initiative will have a serious impact on organisations using DigiCert, GeoTrust, RapidSSL, Thawte, and Encryption Everywhere certificates.

As browser security requirements continue to evolve and the validity periods of SSL certificates continue to shorten, business customers need to develop new policies around how they manage certificate visibility and automation in addition to reviewing their existing internal PKI infrastructure.

In this guide, we will cover DigiCert’s CT logging enforcement, what it means to you, why it is important for you to comply with the compliance deadline, and what steps you must take in advance of the compliance deadline.

What Is Certificate Transparency (CT)?

Certificate Transparency is a public logging system for improving the security of the internet and ensuring that certificates are visible. When a TLS or SSL certificate that is publicly trusted is issued, the information about that certificate will be logged in CT logs, which are publicly accessible. This allows:

• The detection of any mis-issuance of certificates
• The detection of any unauthorised issuance of certificates
• The detection of any attempted domain impersonation
• The detection of any rogue Certificate Authorities.

By providing accountability for the public SSL ecosystem through the documentation of certificate issuances, the CT Logging creates an audit trail for the issuance of certificates.

Also Read: How to Fix ERR_CERTIFICATE_TRANSPARENCY_REQUIRED in Chrome?

Why DigiCert Is Enforcing CT Logging for All Public TLS Certificates

DigiCert is implementing a new rule that will require CT logging for every publicly trusted TLS certificate. This change stems from new requirements by Google for Certificate Authorities to provide CT logs for all certificates being used with public trust.

Before this regulation, there were some existing certificates within the CA’s system that did not have to be logged in a CT log based on either trustworthiness to a browser or an option by the customer. This new rule will require the logging of every publicly trusted TLS certificate in a CT log by June 15, 2026.

This policy applies to:

• DV certificates
• OV certificates
• EV certificates
• Wildcard SSL certificates
• Test certificates
• Reissued certificates
• Duplicate certificates

The requirement affects all DigiCert brands, including:

• DigiCert
• GeoTrust
• RapidSSL
• Thawte

Why CT Logging Matters More in 2026

Every year, compliance requirements become stricter regarding visibility into cybersecurity and trust in browsers.

At the same time, the Lifespan of SSL Certificates continues to be reduced:

• As of 2026, the longest lifespan of a TLS Certificate will be 200 days.
• There are already industry proposals to reduce the lifespan of SSL certificates to 47 days.

As a result, organizations that manage hundreds or even dozens of Certificates will have to renew them continuously.

Let’s take an Example of Managing Certificates Manually:

When you had to renew Certificates once a year, it was manageable. Under a 47-day Certificate lifespan, you must renew each Certificate approximately 8 times per year. If a Company has 100 Certificates, it could have almost 800 renovations in one year.

This means that failure to renew just one Certificate will cause downtime, warnings for the user’s browsers, and disruptions to integration between systems, which ultimately reduces the customer’s trust in that organisation.

Therefore, there is a growing need for certificate lifecycle automation and visibility.

What Changes on June 1, 2026?

Starting June 1, 2026, DigiCert will automatically log all newly issued public TLS certificates to CT logs.

This Includes:

• New certificates
• Renewals
• Reissues
• Duplicate certificates

Additionally, DigiCert will remove all CT logging opt-out options from CertCentral.

Organisations that previously excluded certificates from CT logs for privacy or branding reasons will no longer be able to do so for publicly trusted certificates.

Does This Change Affect Your Organisation?

Your organisation will be impacted only if you are currently maintaining any public TLS certificates that have not yet been logged into a Certificate Transparency (CT) log.

While many organisations use CT logs by default (for the sake of trust), most will not have to make any changes.

If your company has sub-domains that are not visible to the general public, uses confidential naming for its infrastructure, or stores its public SSL certificates in an internal environment, then you should evaluate your existing SSL deployment strategy immediately.

Examples include:

• Internal admin portals
• Staging environments
• Hidden APIs
• Confidential product launches
• Private infrastructure naming conventions

If those certificates rely on public browser trust, they will now appear in public CT logs.

What If You Do Not Want Certificates Publicly Logged?

If you need certificate privacy, publicly trusted TLS certificates are no longer the correct solution. Instead, organisations should move toward:

Private PKI

Private PKI allows organisations to issue certificates internally without public browser trust requirements.

Benefits include:

• No public CT logging
• Internal infrastructure privacy
• Full certificate lifecycle control
• Custom trust hierarchy

Private PKI is ideal for:

• Internal applications
• Corporate networks
• Internal APIs
• Development environments
• Enterprise authentication systems

X9 PKI

DigiCert also recommends X9 PKI for organisations requiring interoperability between multiple organisations while avoiding browser-controlled CT requirements.

This is especially useful for:

• Financial institutions
• Regulated industries
• Enterprise ecosystems
• B2B secure communication

How to Check Whether Your Certificates Are Logged in CT Logs

Organisations can verify certificate transparency logging status directly within DigiCert CertCentral.

You can:

• Review individual certificate orders
• Generate certificate reports
• Filter certificates not logged in CT logs
• Export results in CSV, JSON, or Excel formats

This helps organisations identify certificates that may require migration to private PKI solutions before enforcement begins.

Why SSL Automation Is Becoming Mandatory

The enforcement of certificate transparency will happen at the same time as the trend toward shorter certificates.

The challenge of renewing and monitoring certificates is now the operational problem rather than simply issuing them.

For example, if you had a certificated company with 50 certs and a certificate of 200 days, you could experience 90 renewals every year. If that certificate was reduced from 200 days to 48 days, you could then have almost 400 renewals per year on that same company. Trying to do all of that manually is not only a risk to your business, but it is also not sustainable.

Thus, companies are moving more and more to:

• ACME automation
• Certificate Lifecycle Management (CLM)
• Automated renewal workflows
• Centralised certificate monitoring
• PKI automation platforms

Automation Reduces:

• Downtime risk
• Expired certificate incidents
• Manual workload
• Human error
• Compliance failures

Search