Observed does not mean deployed.
Certificate Transparency and endpoint checks answer different questions. Understand what an observed certificate can tell you, and what still needs checking.
One public record.
One live connection.
What was submitted to a public log?
A CT log records certificates and precertificates submitted to it. A CT monitor reads those records and can find entries that match a domain.
- Evidence
- A public certificate or precertificate record.
- Perspective
- Certificate issuance activity visible in the monitored logs.
- Limit
- No proof that a service installed, loaded, or serves that certificate.
What does this connection receive?
A TLS connection shows the certificate presented by the endpoint that answered. The hostname, port, network path, and vantage point all affect what is tested.
- Evidence
- A certificate presented during a specific TLS connection.
- Perspective
- The endpoint and network route reached by the check.
- Limit
- No proof that every region, backend, or later connection serves the same certificate.
Public visibility can come before final issuance.
Certificate Transparency supports precertificates. A precertificate reflects a certificate authority's intent to issue a certificate. It is not the final certificate your web server will present.
This is why “a CT entry exists” is more precise than “the certificate is already live.” Even a final issued certificate still needs to reach the right service, be loaded by that service, and be presented to a client.
The Let's Encrypt glossary and the Certificate Transparency explanation describe this distinction.
The new certificate exists.
The old one is still served.
Imagine that renewal succeeds and the new certificate appears in a CT log. A reverse proxy misses its reload, so clients continue receiving the old certificate.
Both signals can be accurate. They describe different parts of the workflow.
This example is conceptual, not a BamGuard alert or a live incident.
Useful evidence.
A specific meaning.
In BamGuard, an Observation means a supported monitor found matching certificate metadata. The inventory combines complementary monitors and does not identify the source of each Observation.
Use it to review observed certificate identities, validity dates, and first-detected times. Keep your deployment and endpoint evidence alongside it.
Explore the observation inventory- Certificate Transparency inclusion or public issuance
- Successful deployment or renewal
- The certificate currently served by every endpoint
- Reachability, uptime, or application health
- The safety of a certificate's private key
Check the handoff from certificate to service.
Match the certificate
Compare the observed certificate identity and validity dates with the certificate you intended to deploy.
Test the TLS termination point
Check the hostname and port used by clients, including any CDN, ingress, or load balancer in front of the application.
Consider more than one vantage point
A single successful connection can miss another region, address, or backend. Choose checks that reflect your actual deployment.
Certificate checks are one part of operations. Application health and availability require their own checks.