Add the Expect CT policy to your header response
The Expect CT header policy instructs web browsers to either report or enforce Certificate Transparency requirements. This can stop miss-issued SSL certificates and can be set to either report mode or enforce mode.
Without an 'Expect CT' It's much easier for attackers to utilise miss-issued certificates. If you're going to set it to enforce mode then you definitely need to exercise caution to ensure everything is configured correctly with your SSL. On the majority of my sites I use the full enforce mode as per the below example:
Header set Expect-CT: enforce, max-age=31536000, report-uri="https://your.report-uri.com/r/d/ct/enforce"
You can also just use the report only mode like this:
Header set Expect-CT: max-age=31536000, report-uri="https://your.report-uri.com/r/d/ct/report"