tls.cert.sct_present
Certificate Transparency (SCT Present)
What we check
We check every RFC 6962 Signed Certificate Timestamp (SCT) delivery channel: embedded in the leaf certificate, the TLS handshake extension, and the stapled OCSP response. SCTs prove the certificate was submitted to a public Certificate Transparency log before issuance.
What this finding means
The server provides valid SCTs, proving its certificate was logged in at least one public CT log. This is the expected, healthy state for certificates issued by public CAs.
CT logging enables anyone — domain owners, researchers, browsers — to detect misissued certificates. All major public CAs (including Let's Encrypt) embed SCTs automatically.
How it's graded
SCT presence is a pass and carries no penalty. See Grading Methodology for the full scoring model.
Evidence example
SCT sources: embedded in leaf certificate
CT logs: Google 'Argon2026h1', Cloudflare 'Nimbus2026'
Timestamps: 2026-06-15T10:30:00Z, 2026-06-15T10:30:01Z