TLS Certificate Transparency logs let us assess Certificate Authorities
&gt; There are some complexities in practice, but they can be solved with work.<p>At least one of these complexities can&#x27;t realistically be solved but you likely don&#x27;t care.<p>Certificate Transparency is <i>not</i> a policy requirement. Choosing not to log isn&#x27;t a mis-issuance or a compliance failure. It would of course annoy most ordinary web customers, who expect the certificate you sold them to work in say, Chrome, which it won&#x27;t until it is logged and they teach their web server how to prove that (good luck explaining to the average web site owner how to do that).<p>So, this means unavoidably the population statistics from, say, crt.sh are underestimates.<p>But, probably by a small, and even <i>very</i> small fraction. Dozens? Hundreds a year? There are two cases (besides mistakes) where people wouldn&#x27;t have 100% logged certificates and both are small populations:<p>1. They know what they&#x27;re doing and can arrange to log each certificate as needed for production. Some huge tech companies fall into this bracket, it enables them to get a certificate for shiny-product.example and yet know it won&#x27;t get logged anywhere and cause somebody to pry into what shiny-project is before it&#x27;s announced. It requires their TLS server operators understand how SCTs work, but if they&#x27;re a huge tech company they probably <i>employ</i> some people who wrote the specification.<p>2. They don&#x27;t care about the Web, and are only part of the Web PKI as a result of some historical happenstance they&#x27;d gladly part with at first opportunity. In this case the fact their certificates don&#x27;t work in Chrome makes no difference to them, the certificates aren&#x27;t <i>for</i> Chrome or any web browser, some expensive old industrial device needs a certificate and the ones they&#x27;re using work. Given the choice between buying a brand new $4M industrial device or retro-fitting logging for the six certificates they issue each year, they&#x27;d be very torn and likely find a third way, but for now they don&#x27;t have to. When the device is beyond economic repair their new one won&#x27;t be part of the Web PKI because in hindsight that was a mistake.