If you read “Well, hello there.”, you know I was trying to understand how random hosts were finding brand-new domains that nobody knew about. Traffic was hitting the web servers within minutes of a server spinning up.
I thought I had it figured out with ICANN’s Centralized Zone Data Service, which I wrote about in “The lists are out there.”. I was so confident I had it all figured out.
Well… it turns out there is another very likely way this happens: Certificate Transparency logs.
Certificate Transparency is a process that started around 2013. It requires publicly trusted SSL/TLS certificates to be recorded in public, verifiable logs. That’s a good thing: it lets domain owners, browser vendors, and security researchers spot certificates issued incorrectly or maliciously.
The side effect is that issuing a certificate can expose domain names.
If you use a certificate authority such as Let’s Encrypt or Cloudflare to generate certificates, that’s another way your domain becomes visible. It applies to certificates generated for subdomains, too.
In other words, if you’ve ever thought about creating a unique subdomain for private pages that do not need public attention, don’t assume its name stays quiet. A certificate for that subdomain may effectively announce that it exists.
Practical takeaway: treat a hostname on a publicly trusted TLS certificate as public information.
This video gives a clear explanation of the purpose behind Certificate Transparency logs:
You can search recent Certificate Transparency logs for a domain on CertKit’s CT log search.