CT log monitoring

Every certificate a browser trusts is published in public Certificate Transparency (CT) logs. CertWatchr watches those logs for your hostnames and tells you when a new certificate is issued — including one issued by mistake, by another team, or by an attacker.

Your normal certificate check only sees what your server serves. CT monitoring sees every certificate issued for the name, wherever it is used.

Availability: on for every domain on Starter and Pro. Nothing to switch on.

What you get

• Once an hour, CertWatchr looks up each of your hostnames in the logs.
• The first lookup for a new domain only records what is already there. You get no alert for old certificates.
• After that, you get one "New certificate in CT logs" alert per domain when new certificates appear, with their number — by e-mail and, on Pro, by webhook. Several on one day still mean one alert.

Was the new certificate expected?

Open the domain's page. Certificate Transparency log observations lists the 25 most recent certificates for the hostname, with first-seen date, issuer, name, validity and serial number.

• Your usual CA, around your renewal date: a normal renewal. Nothing to do.
• A CA you do not use, or a date you did not renew: find out who in your organisation requested it. If nobody did, contact the CA.

Hostnames you are not monitoring yet

The logs answer for the whole domain. A lookup for www.example.com also finds certificates for shop.example.com, api.example.com and every other host under example.com. CertWatchr does not alert on those, but it remembers them.

If some are not monitored, Domains shows a note. Click Review to see them:

• Monitor adds the host on port 443 with your default alert threshold.
• Don't suggest again hides it for good.

Only hosts with a certificate that is still valid are suggested. Remove the domain a host was found through, and its suggestions go too.

Which certificates count

• A certificate counts when it names the hostname you monitor, or is a wildcard that covers it. *.example.com covers shop.example.com, but not example.com itself or a.b.example.com — browsers see it the same way.
• Names below the hostname only count if you tick Also alert on certificates for subdomains on the domain's add or edit form. Without it, a certificate for api.example.com does not alert under example.com; it is suggested as a host to monitor instead.
• The logs are read through a public service. If it is briefly down, the next hourly lookup catches up. Nothing is lost.