Transparency
Certificate Transparency monitoring every certificate issued in your name, on the record.
Every certificate a public CA issues is logged in Certificate Transparency at issuance. CertSentry sweeps those logs for your registrable domain and every subdomain - so a certificate you didn't request becomes an alert, not a surprise.
Free personal workspace forever · No credit card
The coverage
What this watch covers
Whole-domain coverage
One watch covers example.com and everything beneath it - including the subdomains you forgot exist.
A silent baseline
Existing certificates are recorded without a flood of alerts on day one. From then on, only genuinely new issuance notifies.
Two independent sources
CT data is read from CertSpotter with automatic failover to crt.sh, so one provider's outage doesn't blind the watch.
The earliest compromise signal
A certificate you don't recognize can mean a hijacked DNS record, a compromised CA account or a phishing setup in progress. CT is where it shows first.
Questions
Common questions
Why would a certificate appear that I didn't request?
Often legitimately: a CDN, a SaaS provider or a teammate automating renewal. The point of the watch is that you get to decide which it is - within a day, not months later.
How quickly will I know about new issuance?
CT logs are swept daily. New certificates for your domain raise an alert on the sweep that finds them.
Does it cover subdomains?
Yes - monitoring is per registrable domain and includes all subdomains, current and future.
Which plans include it?
Certificate Transparency monitoring is available on Pro and Agency plans.
The rest of the watch
Also on watch
- SSL certificatesExpiry ladder alerts, broken-cert detection and a TLS grade per check.
- Domain expiryRegistry-sourced expiry dates with the 30-to-1-day warning ladder.
- DNS changesDaily snapshots of six record types, alerting only on confirmed changes.
- UptimeChecks from 7 regions; down only when two regions agree, twice.
- Cron jobs & heartbeatsA ping URL per job; an alert the moment the pings stop.
- DMARC reportsParsed aggregate reports, new-sender alerts and failure-rate warnings.
The next expiry email you get should be from us.
Not from a furious client. Add your first domain in under a minute.
Start the watch - free