Certificate Transparency: Why Certificates Reveal Your Subdomains
What Certificate Transparency logs are, which domain data they hold, how hidden subdomains are found through them and how to issue certificates safely.
Certificate Transparency (CT) is a set of public logs where certificate authorities must record every TLS certificate they issue. Browsers do not trust certificates without a log entry, so it cannot be bypassed.
What goes into the log
Every hostname the certificate covers, the issue date and the certificate authority. If one certificate covers shop.example.com, admin.example.com and test-server.example.com, all three names become public forever. The logs are indexed by certificate search services, and finding all subdomains of a domain through them takes seconds.
What the risk is
- Exposure of internal and test subdomains and admin panels.
- Linking projects together when they share one certificate.
- A hint to attackers about where to look for weak spots.
How to issue certificates carefully
- One certificate per public hostname, or a wildcard
*.example.com: the wildcard hides specific subdomains. - Internal services on a separate domain or without a public certificate.
- Do not mix projects in one certificate.
- Behind Cloudflare the certificate is issued on its side, and only the names you proxy end up in the log.
Domain privacy is made of several layers, and CT is the one people forget most often. The rest are covered in the guide WHOIS privacy explained.
Register a domain in 2 minutes
1,500+ zones, WHOIS privacy on request, crypto payment and DNS management — all inside the Telegram bot.
FAQ
Can an entry be removed from a Certificate Transparency log?
No. The logs are designed so that entries cannot be deleted or changed; you can only avoid creating unnecessary ones.
Does a wildcard certificate fully protect subdomains?
It hides their names in the log, but the subdomains themselves remain reachable in DNS if records exist for them.
Register a domain in 2 minutes
1,500+ zones, WHOIS privacy on request, crypto payment and DNS management — all inside the Telegram bot.