What this check inspects
Shipwork queries the public Certificate Transparency search at crt.sh for certificates covering your domain, excluding expired ones, and lists the distinct subdomains and the issuers seen. It retries once because the free service is often slow, and reports plainly when it cannot reach it rather than pretending the domain has no certificates.
What a failure means
This check is mostly informational. Its value is what it surfaces: a staging or dev subdomain with a valid certificate may be publicly reachable and indexable, and an unexpected issuer can mean a certificate was issued to someone you do not control.
How to fix it
- Look through the subdomains for staging, dev, test, admin and old project names.
- Put authentication or a network rule in front of any environment that is not meant to be public.
- Add robots noindex to non-production hosts as a second layer, not as the only layer.
- Check the issuers. If an authority you do not use has issued for your domain, investigate.
A typical failure, worked through
The setupA store spun up staging.example.com eighteen months ago for a theme migration and never took it down. It still holds a valid certificate and serves the old catalogue.
What the check reportsThe CT lookup lists staging.example.com among the subdomains covered by certificates for example.com. A quick fetch confirms it answers without authentication.
The pointCertificate logs do not care that the host was temporary. If it was ever publicly certified, the name is public.