The certificate that takes a site down is rarely the main website's. It's the one on old-shop.example.com, a partner portal, or an API endpoint someone set up years ago. You can't monitor what you don't know about, and Certificate Transparency is the quickest way to find out.
What Certificate Transparency is
Since 2018, browsers only trust public certificates that have been recorded in public, append-only Certificate Transparency (CT) logs. Every public certificate issued for your domains is in those logs, whoever requested it and from whichever authority. So the logs are a complete list of certificates for your names, free to search.
Search with crt.sh
crt.sh is a free search engine over the CT logs.
- Search for
%.example.com. The%is a wildcard, so this finds every subdomain. - Tick Exclude expired (or add
&exclude=expiredto the URL) to see only certificates still valid. - Each row shows the names on the certificate, the issuer and the validity dates.
Also search for the bare domain example.com, and for any other domains you own.
Get a clean list of names
crt.sh can return JSON. This command lists every distinct hostname with a currently valid certificate (requires curl and jq):
curl -s "https://crt.sh/?q=%25.example.com&output=json&exclude=expired" \
| jq -r '.[].name_value' | tr '[:upper:]' '[:lower:]' | sort -u
%25 is the URL-encoded %. Wildcard entries (*.example.com) show which wildcards exist, but not which hosts use them, so check those with your teams or DNS.
crt.sh is a free community service and can be slow or time out for large domains; if so, try again later, or search on the Google Transparency Report.
Turn the list into an inventory
For each hostname, note:
| Hostname | Who owns it | Where the certificate lives | Issuer | How it's renewed |
|---|---|---|---|---|
www.example.com |
Web team | Load balancer | Let's Encrypt | Automatic (Certbot) |
api.example.com |
Platform | AWS ALB | Amazon | ACM managed |
vpn.example.com |
IT | Firewall appliance | Commercial CA | Manual, renew before July |
The "how it's renewed" column is the useful one: anything manual is a future outage, especially as lifetimes shrink to 47 days (checklist).
Things the logs reveal
- Forgotten subdomains that still resolve and serve a certificate.
- Certificates you didn't request: from a vendor, an agency or a misconfigured service. Unexpected issuance is also an early warning sign of a compromised DNS or hosting account.
- Several certificates for one name, usually a sign that more than one system serves it.
Keep it up to date
New subdomains appear all the time. Re-run the search every quarter, and add each new hostname to monitoring as soon as it goes live.
CertHalo monitors every hostname you add, on any port, and emails you before each certificate expires or when one changes unexpectedly. Monitor 3 certificates free, or check any of them now with the SSL checker.