Expect-CT

Expect-CT is a web security header that allows websites to enforce Certificate Transparency (CT) requirements for their SSL/TLS certificates. It helps detect misissued or malicious certificates by requiring browsers to check that certificates are logged in publicly auditable CT logs. This mechanism enhances HTTPS security by ensuring certificate authorities comply with transparency standards.

Also known as: Expect CT, ExpectCT, Certificate Transparency Enforcement, CT Enforcement Header, HTTP Expect-CT

Why learn Expect-CT?

Developers should implement Expect-CT to improve security for HTTPS-enabled websites, particularly in environments where certificate misissuance is a concern, such as high-risk financial or government sites. It is crucial for compliance with modern security standards like those from the CA/Browser Forum, and helps prevent man-in-the-middle attacks by ensuring certificates are publicly logged and monitored.

Learning Resources

• docs: MDN Web Docs: Expect-CT
• docs: Google Security Blog: Expect-CT
• tutorial: Certificate Transparency Explained
• docs: OWASP Security Headers Guide