A certificate you didn't order

Every publicly trusted certificate issued for your domain is written to a public, append-only Certificate Transparency log. Not by you — by the certificate authority, as a condition of being trusted by browsers at all.

Which means there is a public record of every certificate anyone has ever obtained for your domain, and almost nobody reads it.

What an SSL check cannot see

An SSL check connects to port 443 and looks at the certificate being served. It tells you when that certificate expires, who issued it, and which names it covers. Our free SSL checker does exactly this, and so does everyone else's. That is genuinely useful and it is what most monitoring does.

It is also blind to the interesting question. It can only see the certificate you are serving. It cannot see a certificate that exists, is valid for your domain, and is being served somewhere else entirely.

The three things people find

Shadow IT. A team stands up app-staging.yourcompany.com on a platform that provisions certificates automatically. It works, so nobody mentions it. Two years later it is still running, unpatched, on a version of something nobody has updated since.

A departing contractor. Someone with DNS access points a subdomain at their own host and takes a certificate for it. The certificate is legitimate — they controlled the DNS at the moment of issuance. It stays valid for ninety days after they lose access.

A wildcard nobody sanctioned. A wildcard certificate covers every subdomain at once, so a single one taken by the wrong person covers hosts that do not exist yet. A CAA record is the control that would have prevented it, and almost no domain has one.

An issuer you have never used. Your certificates come from one CA. A certificate appears from a different one. That is either a colleague who did not know the process, or something worth investigating today.

Why the naive version is useless

The obvious implementation — alert on every new certificate — is unusable within a week. A busy domain reissues constantly: Let's Encrypt renews every sixty days, a CDN may reissue on its own schedule, and every subdomain is its own stream of renewals. You would get several alerts a day, all of them routine, and you would mute it.

What is actually news is a change in surface: an issuer you have not seen before, or a hostname that is new to the log. A renewal of a certificate you already know about is not news, and treating it as news is how a good signal gets thrown away.

That is why IT Watch fingerprints the set of issuers and covered names rather than individual certificates, establishes a baseline silently on the first check, and only alerts when the surface changes.

Reading the logs yourself

You do not need a product for this. crt.sh will show you every logged certificate for a domain, free, right now. Search your own domain and look at the hostname list.

Most people find at least one thing they had forgotten about. Some find something they never knew.

The alerting is the same five-rung ladder as everything else, for the same reason.

The reason to automate it is not that the lookup is hard. It is that you will do it once, find nothing alarming, and never do it again — and the certificate that matters will be issued in eight months.