Certificate Transparency Check

Searches the public Certificate Transparency logs (via crt.sh) for all certificates ever issued for your domain. CT logs are an open register — every CA must record issued certificates there.

Check	What is checked
Certificate count	How many certificates exist in total, how many were issued in the last 90 days, which CAs issued them?
Unknown CAs	Do all certificates come from known CAs (Let's Encrypt, DigiCert, Sectigo, …)? Unknown issuers can indicate unauthorized certificates (warn).
Expiring certificates	Does one of the found certificates expire in the next 30 days?
Subdomains	Which subdomains appear in the certificates? CT logs often reveal forgotten or internal subdomains.
Reachability	Which of the found subdomains still respond to HTTP(S)? Entries no longer reachable are candidates for cleanup.

Subdomains are public

Everything in a certificate is visible to anyone via CT logs — including staging., intern. or vpn. subdomains. Wildcard certificates (*.example.com) avoid this.