Certificate transparency logs are public, append-only records of issued website certificates. Searching them for your domain shows hostnames that have had certificates, who issued them and when. That makes them a cheap way to find forgotten hosts and to notice certificates you did not request.
What the logs are
Certificate Transparency is an ecosystem that makes certificate issuance transparent and verifiable. It relies on independent logs that anyone can check, that can only be added to, and that resist tampering. Domain owners can review them to see which certificate authorities issued certificates, when, and for which domains, which helps catch certificates issued by mistake or on purpose without the owner's knowledge. Independent organisations run monitors on top of the logs.
What you can learn
Searching a domain gives you rows of hostnames, issuer names and dates. From that you can:
- Find subdomains that exist or once existed
- Spot a certificate from a certificate authority you never use
- See when a new hostname first got a certificate
- Notice hostnames that look like yours but are not, if you search for lookalike strings
Reading the results
A hostname in the logs is a lead, not proof it is live. Resolve it in DNS. If it resolves, find the owner. If it does not resolve but a DNS record still points elsewhere, you may have a dangling record to clean up.
Wildcard certificates hide detail. A wildcard entry tells you a certificate covers every subdomain at that level but not which exist.
A simple routine
- Search your main domains and any brand domains.
- Export the list of hostnames.
- Compare it with your inventory.
- Resolve the differences.
- Assign owners or delete.
- Repeat monthly, or set up a monitor that alerts on new certificates.
Limits
- Private or internal certificates are generally not in public logs, so internal hosts will not show up.
- A hostname can serve traffic with no certificate in the log, for example plain HTTP.
- Logs record issuance, not who is using the certificate now.
What to do about a certificate you did not request
Treat it as a possible incident. Check with your own teams first, since agencies and vendors often request certificates for hosted sites. If nobody claims it, contact the issuing authority, and review the DNS records for the domain.
Teams that rely on agencies, hosting platforms or website builders should expect certificates they did not request directly. Keep a list of approved issuers and platforms so that a certificate from an unknown source stands out. Review the list when you change vendors.
Where Safeguard fits
Safeguard does not monitor certificate logs. It covers asset discovery and dependency scanning for software, and a free scan is available at gold.safeguard.sh/scan.
Quick check
Does a certificate in the log mean the host is up?
No. It shows issuance only. Resolve the name and test it to see whether it is live.
Sources
Last reviewed: 19 October 2026.
