How it works
Every public certificate authority must publish each certificate it issues in Certificate Transparency logs. Once a day, we search those logs (through crt.sh) for certificates issued for your domain, and alert you about:
- a certificate for a host name never seen before, such as a new subdomain;
- a certificate from an authority that has never issued one for your domain before.
Either can reveal an attacker who got a certificate for your domain, a phishing subdomain, or a server someone set up and forgot to tell you about. Renewals for known names from known authorities stay quiet. The first run records what already exists, and new names and authorities join that baseline after one alert.
The host names found here are also checked by the Subdomain takeover check.
Statuses
| Status | Meaning |
|---|---|
| OK | No certificates for new host names or from new authorities. |
| Warning | A new certificate was found. The report lists the name, issuer and date. |
By default you are notified of warnings and failures.
What to do
- You recognise it: a teammate added a subdomain or switched certificate providers. Nothing to do; the next run treats it as known.
- You don't recognise it: find out who requested it. If it is unauthorised, ask the authority to revoke it, and review who can change your DNS. A CAA record limits which authorities may issue certificates for your domain.