Find every SSL certificate on your domain: an owner's guide

Step 1: search the logs

Certificate authorities publish the certificates they issue in public Certificate Transparency logs. crt.sh is a free search over those logs, with no account. Search for this, with your domain in place of the example:

%.example.com

The % means "anything before this", so you get names under your domain. Search your bare domain too, because example.com on its own may not match. Adding &exclude=expired to the page's address leaves out expired certificates.

Expect it to be slow or to fail. crt.sh is a free service under heavy load. Our own search for a small domain's subdomains returned a 502 error while we wrote this, while the search for the bare name worked. Try again later, or at a quieter hour.

Step 2: clear out the noise

The results look longer than they are. Three things to know:

Nearly everything appears twice or more. A certificate is usually logged once as a "precertificate" and again as the final one, and renewals add more rows. When we searched a bare domain, we got 8 rows, all with the same dates, covering just 2 names. You want the distinct names in the "Matching Identities" column.
*.example.com is one wildcard certificate, and it hides names. Every name under it shares that certificate, and the logs won't tell you which names those are. Check your DNS records for them.
Old names stay in the logs. Even with expired certificates excluded, a name can have a current certificate for a service you stopped using.

Step 3: sort each name

Run each name through the check above, and put it in one of these rows.

What you see	What it usually means	What to do
Works, and you know what it is	A live service	Note who renews it. Add it to your list
Works, and nobody knows what it is	Often something your host set up, such as `webmail.` or `cpanel.`, or a forgotten tool	Ask your host, or look at where the DNS record points
Fails, and you still need it	An expired or wrong certificate, or the service is down	Fix it today. The check says what failed
Fails, and it's retired	An old DNS record is still there	Delete the record. A name left pointing at a service you've closed can sometimes be taken over by whoever signs up there next
The check can't find the name	The DNS record is already gone	Leave it off your list

Step 4: write down who renews it

For each name you keep, write down one of three answers: the host or CDN renews it, a tool on a server renews it, or a person does. If nobody's sure, treat it as a person. Those are the ones to move first, because from March 2027 public certificates last 100 days at most, which means at least four renewals a year each.

What this won't find

Names under a wildcard (see above).
Internal certificates from your own private authority, which don't go in public logs. Firewalls and other equipment can have these.
Sites with no certificate at all. Your DNS records list those.

So check this list against your DNS records, which are the other half of the picture. Your DNS host's export usually takes a minute.

Keeping it current

Run this search again a few times a year, or when something changes hands. New names show up, and so can a certificate you didn't ask for, which is worth looking into.

To be warned before each one expires, you have a few options, compared in how to get warned now. One is our certificate watch, on Domain Health's paid plans from 10 hostnames at $9 a month. It doesn't find names for you, so you'd paste in the list you just made.

Sources: crt.sh, searched November 2, 2026. Certificate lifetimes: CA/Browser Forum Baseline Requirements.