RunTheTests
/

Certificate Transparency Search

Every hostname anyone has ever certified for a domain — already public.

The domain to look up

Queries go straight from your browser to public resolvers and registry services. Nothing about the domain you look up passes through this site.

How this check works

Every publicly trusted certificate issued since 2018 is written to public, append-only logs. That exists so a certificate mis-issued for your domain can be detected by anyone watching, which is genuinely valuable — and it has a consequence people do not expect. Requesting a certificate publishes the hostname, permanently. So the logs contain every name anyone has ever certified for a domain, including the ones nobody meant to advertise: dev, staging, vpn, jenkins, backup. This lists them, and flags the ones whose labels suggest they were never intended to be found.

What the results mean

Names that look internal
Hostnames whose leftmost label is one used by convention for environments, tooling or remote access. Already public — the search only tells you which.
Wildcards
A single certificate covering every subdomain. Convenient, and it means one compromised key covers everything.
Expiring soon
Currently valid certificates within thirty days. Worth confirming renewal is automated rather than diarised.
Issuers
Who signed them. A certificate from an authority you do not use is worth investigating immediately.

Common problems and fixes

Our internal hostnames are listed
They were published when the certificates were requested, and they cannot be unpublished — the logs are append-only by design. Treat those names as known and make sure what is behind them does not depend on obscurity.
The search returned nothing
Usually the log service being slow rather than an absence of certificates. Try again in a minute before concluding anything.
There is a certificate we did not request
That is exactly what these logs exist to surface. Check the issuer and the dates, and if it is genuinely unauthorised, report it to that authority — they are obliged to act.

Frequently asked questions

What is certificate transparency?

A set of public, append-only logs that every publicly trusted certificate must be written to. Browsers refuse certificates that are not logged, which means anyone can watch for a certificate issued for their domain without their knowledge — the mechanism that catches a compromised or careless certificate authority.

Do certificate logs expose my subdomains?

Yes, and this surprises people. Requesting a certificate for an internal-sounding hostname publishes that hostname permanently — the same property that makes mis-issuance detectable makes your naming a matter of public record. There is no way to remove an entry, so the practical response is to stop treating hostnames as secret. Anything that is only safe because nobody knows its name is not safe.

Can I use a wildcard to avoid publishing names?

It works, and it trades one risk for another. A wildcard certificate for *.example.com publishes no individual hostname, and it also means a single private key covers every subdomain — so a compromise anywhere is a compromise everywhere. Which trade is right depends on what those hosts are.

More in WebAudit