CertLensCertLens privacy policy
Effective 2026-09-06. Applies to the CertLens browser extension (the consumer build). CertLens Fleet is a separate, policy-installed build for organizations and is covered by the organization's own notice.
The short version
CertLens watches the TLS certificates your browser is shown and keeps an inventory of them on your machine. It sends nothing anywhere unless you turn on a specific network feature, and every such feature says, next to its switch, exactly what it sends and to whom.
What CertLens records
For every HTTPS connection your browser makes, Chrome hands the extension the server's certificate. CertLens stores, in the browser's own local database (IndexedDB) on your device:
- the certificate itself and what is parsed from it (names, issuer, key, validity, extensions),
- the hostname it was served for, the server IP address, when it was seen and how often (aggregated per day),
- findings that CertLens's rules raise about those certificates and hosts, and your actions on them (acknowledge, snooze, mute, pin),
- your settings.
Incognito windows use a separate, ephemeral extension context whose data disappears with the window, and Chrome does not hand incognito traffic to extensions at all unless you allow it.
CertLens does not record page content, form data, cookies, URLs beyond the hostname, or anything you type. It has no account, no identifier, no analytics and no telemetry.
What leaves your machine, and only if you switch it on
All of these are off by default. Each switch in Settings shows the sentence below.
| Feature | What is sent | To whom |
|---|---|---|
| Refresh the CT log list | A request for a static file | Google (gstatic.com). Reveals that you use CertLens, nothing about your browsing. |
| CT lookup | The public key hash and the certificate's name | crt.sh (Sectigo). crt.sh learns which sites you visited. One confirmed query at a time, or automatic for pinned hosts or all new certificates, as you choose. Names matching your exclusion or internal patterns are never sent. |
| Fetch issuer certificates (AIA) | A request for the CA's certificate, at the URL the certificate names | The certificate authority. It learns that someone asked for its certificate, not which site prompted it. |
| Check revocation (OCSP) | The certificate's serial number | The certificate authority's OCSP responder. It learns which certificate you are checking, and when. |
| Look up unknown networks | A server IP address the bundled table does not cover | RIPE NCC (stat.ripe.net). RIPE learns the address you connected to, which is enough to tell which site. |
| Monitoring a host | A TLS connection to the host you asked CertLens to watch, on your schedule | That host. |
| Probe | A TLS connection to the host you typed | That host. |
When a feature is off, a per-item button can still perform a single action after you confirm a dialog that names the destination.
What CertLens puts on pages
A content script runs on HTTPS pages you visit. It asks the extension about that page's own certificate and, only when the certificate was issued by a private CA installed on your machine or is self-signed, or when open high-severity findings exist for the host, it shows a banner or badge on the page. It reads nothing from the page and sends nothing. You can turn it off in Settings.
Export
Exports (JSON, CSV, PEM, HTML and Markdown reports, backups) are files you download. They may contain hostnames and certificates from your browsing. Sharing them is your decision.
Retention and deletion
Observations are pruned after the retention period you set (90 days by default); certificates, hosts and findings are kept until you remove them. Settings > Reset deletes the inventory. Uninstalling the extension deletes everything.
Permissions
webRequestand access to all sites: to be shown each connection's certificate. A site the extension cannot see is a certificate missing from the inventory.storage,unlimitedStorage: the local database.tabs: to know which tab a certificate belongs to, and to show the popup for the current site.alarms: the periodic re-evaluation of expiry and rules.notifications: alerts for findings, at the threshold you set.sidePanel: the live feed.
CertLens does not request the debugger permission. (CertLens Fleet does, for its deep-mode handshake inspection; that build is not on the public store.)
Changes and contact
This policy changes only with a new extension version, and the change is described in the release notes. Questions and reports: the support page.