Certbat

Accessible Certificate Transparency Log Monitoring for Domain Owners

In the X.509 PKI system, any trusted Certificate Authority may issue a valid TLS certificate for any domain. Certificate Transparency (CT) makes such issuances observable, but domain owners still have to monitor the logs to detect wrongful or malicious certificates. This is a nontrivial and inaccessible task, especially for domain owners with limited resources.

Certbat is free software intended to make self-hosted CT log monitoring more accessible. It discovers the domains to monitor from common web servers, crawls the logs for matching certificates, compares them to the deployed certificates and alerts if anything suspicious is found. It can optionally store log history using Bloom filters, so that further domains can be configured later without re-downloading the entire history of every log.

Certbat fetches entries from the CT logs, detects domains and fetches certificates from the web server, and alerts the server administrator about suspicious certificates.

Certbat was developed by Philip Stoop and Dominic Wenger as Bachelor thesis at the Bern University of Applied Sciences in 2026, advised by Christian Grothoff.

Resources

Report (PDF)
Source code (Codeberg, GNU AGPLv3)

Citation

@techreport{stoop2026certbat,
  author      = {Philip Stoop and Dominic Wenger},
  title       = {Certbat: Accessible Certificate Transparency Log Monitoring for Domain Owners},
  type        = {Report},
  institution = {Bern University of Applied Sciences},
  year        = {2026},
  url         = {https://certb.at/certbat.pdf}
}