Detect mis-issuance and unexpected certificates using CT logs, CAA policy, and issuance history — without alert fatigue.
Operated by Cavalry Scout Pty Ltd (Australia).Privacy·Contact·Documentation
Security operations, platform engineering, and IT teams responsible for owned domains, partner zones, and lookalike monitoring. If you have outgrown ad-hoc CT log queries but do not want a firehose of renewal noise, this product is built for you.
Webhooks to Splunk, Slack, Microsoft Teams, and generic SIEM endpoints; richer tenant APIs; SSO for Enterprise. We do not claim global regex CT search or live credit billing in this release — see indicative pricing.
Certificate Transparency logs make issuance visible, but raw log volume is overwhelming. Security and platform teams need to know when something changed that should not have — a new CA, a name that never appeared before, or a cert that violates your issuance policy.
We surface unexpected certificate issuance — not every routine renewal — so your team stays focused on real risk.
Use DNS CAA where available, and define private issuance policy per tenant when you need stricter control than public DNS allows.
Track whether a certificate or name set was seen before, whether the issuing CA changed, and whether issuance follows an expected cadence.
Monitoring is powered by CT log ingestion (via our ctlogdaemon pipeline) and analysis — not periodic certificate store scraping alone.
| Aspect | Manual CT review | Good Roots Work |
|---|---|---|
| Noise level | High — every renewal and duplicate SAN cert creates work | Low — alerts focus on anomalies and policy violations |
| CAA alignment | Manual cross-check against DNS or spreadsheets | Automatic public CAA evaluation; optional private policy per tenant |
| Historical context | Hard to remember prior issuers and cadence | Issuance history informs whether an event is expected |
| Operational load | Analyst time spent triaging CT log queries | Continuous ingestion with edge API access for the tenant app |
