ShipworkSite inspection
Checks
Every error, explainedGuides →
Pricing Learn Guides

Which subdomains do certificate logs reveal?

Every certificate a certificate authority issues is published to Certificate Transparency logs, and those logs are public. They are a reliable map of your subdomains, including the ones you hoped were private.

Runs the free audit, which includes this check where it applies to your site. Nothing is stored.

What this check inspects

Shipwork queries the public Certificate Transparency search at crt.sh for certificates covering your domain, excluding expired ones, and lists the distinct subdomains and the issuers seen. It retries once because the free service is often slow, and reports plainly when it cannot reach it rather than pretending the domain has no certificates.

What a failure means

This check is mostly informational. Its value is what it surfaces: a staging or dev subdomain with a valid certificate may be publicly reachable and indexable, and an unexpected issuer can mean a certificate was issued to someone you do not control.

How to fix it

  1. Look through the subdomains for staging, dev, test, admin and old project names.
  2. Put authentication or a network rule in front of any environment that is not meant to be public.
  3. Add robots noindex to non-production hosts as a second layer, not as the only layer.
  4. Check the issuers. If an authority you do not use has issued for your domain, investigate.

A typical failure, worked through

The setupA store spun up staging.example.com eighteen months ago for a theme migration and never took it down. It still holds a valid certificate and serves the old catalogue.

What the check reportsThe CT lookup lists staging.example.com among the subdomains covered by certificates for example.com. A quick fetch confirms it answers without authentication.

The pointCertificate logs do not care that the host was temporary. If it was ever publicly certified, the name is public.

Questions

Is Certificate Transparency legal data?
Yes. Every publicly trusted certificate authority is required to log certificates, and the logs are public by design.
Can I remove a subdomain from the logs?
No. Certificates cannot be unlogged. You can expire the certificate and take the host down, but the name stays visible in historical logs.
Does a subdomain in the logs mean it is reachable?
Not necessarily. It means a certificate existed. Whether the host still resolves and answers is a separate question, which is why the DNS and certificate checks are worth running after this one.

Related checks and guides