Certificate Transparency and TLS Best Practices for Indian Websites

Certificate Transparency (CT) is a public logging system that records every SSL/TLS certificate issued, allowing domain owners to detect unauthorized certificates for their domains. For Indian websites, implementing CT monitoring alongside TLS best practices (TLS 1.3, HSTS, strong cipher suites, and proper certificate management) is essential for security — especially as CERT-In now mandates incident reporting within 6 hours, making early detection of certificate fraud critical for compliance.

Last updated October 2026

What Is Certificate Transparency and Why Should Indian Businesses Care?

Certificate Transparency (CT) is a framework created by Google that requires Certificate Authorities (CAs) to log every certificate they issue in public, append-only logs. Anyone can query these logs to verify that a certificate was legitimately issued.

For Indian businesses, CT matters because:

• Phishing detection: Attackers frequently register lookalike domains (e.g., themad.in vs. themad-india.in) and obtain legitimate certificates for them. CT logs let you detect these within minutes of issuance
• Rogue certificate detection: If a CA issues a certificate for your domain without your knowledge (CA compromise or employee error), CT logs reveal it
• Compliance: The DPDP Act 2023 and CERT-In guidelines emphasise data-in-transit protection. CT monitoring demonstrates proactive security posture
• Brand protection: Indian brands face significant phishing targeting — banking, e-commerce, and fintech companies see thousands of phishing attempts monthly

How to Monitor Certificate Transparency Logs

Several free and paid tools monitor CT logs for your domains:

• crt.sh: Free web interface by Sectigo. Search any domain to see all issued certificates. Bookmark https://crt.sh/?q=%.yourdomain.in for wildcard monitoring
• Facebook Certificate Transparency Monitor: Free, sends email alerts when new certificates are issued for your domains
• Certspotter (SSLMate): Free tier monitors up to 5 domains with email alerts. Paid plans from $15/month (~₹1,250)
• Google Certificate Transparency search: Integrated into Chrome DevTools Security tab
• Hardenize: Free tier includes CT monitoring alongside other security checks

For Indian companies managing multiple domains (.in, .co.in, .com), set up monitoring for all variations including common typos.

TLS Configuration Best Practices for 2026

Protocol Version: TLS 1.3 Only

TLS 1.3 should be your minimum protocol version in 2026. It provides:

• Faster handshakes: 1-RTT (round trip time) vs. 2-RTT for TLS 1.2 — critical for Indian users on high-latency mobile connections
• Stronger security: Removed vulnerable cipher suites, mandatory forward secrecy
• 0-RTT resumption: Returning visitors experience near-zero handshake latency

Disable TLS 1.0 and 1.1 (already deprecated). TLS 1.2 can remain enabled as a fallback for older corporate proxies and government SWAN network clients, but monitor its usage and plan to disable it by 2027.

Cipher Suite Configuration

For TLS 1.3, these cipher suites are automatically negotiated (you can’t misconfigure them):

• TLS_AES_256_GCM_SHA384
• TLS_AES_128_GCM_SHA256
• TLS_CHACHA20_POLY1305_SHA256

For TLS 1.2 fallback, prefer ECDHE key exchange with AES-GCM. Disable CBC mode ciphers, RC4, 3DES, and any cipher suite without forward secrecy.

HSTS (HTTP Strict Transport Security)

HSTS tells browsers to always use HTTPS for your domain. Implement it in stages:

1. Start with a short max-age: Strict-Transport-Security: max-age=300 (5 minutes) to test
2. Increase to 6 months: max-age=15768000
3. Add includeSubDomains: max-age=31536000; includeSubDomains
4. Submit to the HSTS preload list: max-age=31536000; includeSubDomains; preload

For Indian e-commerce sites, HSTS preloading is strongly recommended — it prevents SSL stripping attacks on public WiFi networks in malls, airports, and co-working spaces.

Free vs Paid SSL Certificates for Indian Websites

Security Headers Beyond HSTS

A complete security header configuration for Indian websites should include:

• Content-Security-Policy (CSP): Prevents XSS by controlling which resources can load. Start with report-only mode, then enforce
• X-Content-Type-Options: nosniff: Prevents MIME-type sniffing
• X-Frame-Options: SAMEORIGIN: Prevents clickjacking (or use CSP frame-ancestors)
• Referrer-Policy: strict-origin-when-cross-origin: Controls referrer information shared with third parties
• Permissions-Policy: Restrict access to browser features (camera, microphone, geolocation) to only the origins that need them

Test your headers with securityheaders.com — aim for an A+ rating. Most Indian websites score D or F because they haven’t configured any security headers.

Certificate Management for Indian Enterprises

Large Indian organisations often struggle with certificate management across dozens or hundreds of domains and subdomains. Common issues:

• Certificate expiry: Let’s Encrypt certificates expire every 90 days. Automate renewal with certbot or your hosting panel’s built-in auto-renewal
• Shadow IT certificates: Marketing teams buying certificates for campaign microsites without IT knowledge
• Mixed content: HTTP resources loaded on HTTPS pages, triggering browser warnings
• Certificate pinning mistakes: Avoid HTTP Public Key Pinning (HPKP) — it’s deprecated and risky. Use Certificate Transparency monitoring instead

Indian Regulatory Context

CERT-In’s April 2022 directive and subsequent DPDP Act 2023 implications for TLS:

• 6-hour mandatory incident reporting for detected security breaches (including certificate compromise)
• VPN providers, data centres, and cloud services must maintain logs for 5 years
• SSL/TLS certificate issuance logs may be requested during security audits
• Government websites (.gov.in, .nic.in) are mandated to use certificates from India PKI (NIC CA or CCA-approved authorities), though many still use global CAs

Frequently Asked Questions

Is Let’s Encrypt sufficient for Indian business websites?

For most Indian SMBs and startups, yes. Let’s Encrypt provides the same encryption strength as paid certificates. The main limitation is lack of organisation validation — your business name doesn’t appear in the certificate. For e-commerce processing payments, a DV certificate from Let’s Encrypt combined with proper security headers and a PCI-compliant payment gateway (Razorpay, Cashfree) is perfectly adequate.

How often should Indian companies audit their TLS configuration?

Quarterly, at minimum. Use SSL Labs (ssllabs.com/ssltest) for each external-facing domain — aim for an A or A+ grade. Also audit after any server or hosting migration, CDN changes, or security incidents. Automate weekly scans with tools like Hardenize or Mozilla Observatory.

Does Cloudflare’s free SSL replace the need for a certificate on my origin server?

No. Cloudflare’s “Flexible SSL” mode encrypts traffic between users and Cloudflare but leaves the connection between Cloudflare and your origin server unencrypted. Always use “Full (Strict)” mode with a valid certificate on your origin server. This is especially important for Indian hosting providers where shared servers might be on compromised networks.

What happens if someone obtains a fake certificate for my Indian domain?

If you’re monitoring CT logs, you’ll detect it within minutes to hours. File a revocation request with the issuing CA, report the domain to Google Safe Browsing, and if it’s being used for phishing, file a complaint with CERT-In and the domain registrar. Also report to the Anti Phishing Working Group (APWG) at reportphishing@apwg.org.

Should Indian government and banking websites still use EV certificates?

EV certificates no longer show the green address bar or company name in modern browsers (Chrome, Firefox, Edge all removed this UI indicator by 2020). However, EV still provides the highest level of CA-verified identity and may be required by specific RBI or UIDAI compliance guidelines. Check your regulator’s current requirements before spending ₹20,000–₹50,000/year on EV when OV at ₹5,000–₹15,000/year provides the same encryption.