Skip to content

Want notifications when a cert is issued for my domain (intended or not)

Certificate Transparency is a public log where every issued cert appears. With a free monitor (crt.sh, Cert Spotter, Sectigo) you get alerts when an unknown party or forgotten dev environment pulls a cert for your domain.

Try this first

  1. 1Sign up for Cert Spotter (sslmate.com/certspotter) or similar CT monitor with your apex domain.
  2. 2Also add *.vectel.nl and related domains, otherwise you miss certs for subdomains issued by a vendor.
  3. 3When an alert hits: compare with your own register. Known = fine, unknown = investigate with IT/marketing/dev.
  4. 4Combine with a CAA record that allows only your approved CAs, that filters accidental issuance at the source.
  5. 5Document which CAs you use (Let's Encrypt, ZeroSSL, paid EV) and review the CAA record every six months.

When to bring us in

If you keep getting mystery certs for your domain and do not know who pulls them, we can trace the origin and tighten CAA.

See also

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.

Who are you?

For the AI question we need your email and company, so we can follow up if the AI gets stuck, and to prevent abuse.

Limited to 2 questions per hour and 5 per day, kept lean so the AI stays useful. For more, contacting us directly works better for you and us.

Or skip the DIY entirely

Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.