Certificate Transparency — Every Certificate Ever Issued for Your Domain
Every publicly trusted certificate is recorded in append-only Certificate Transparency logs, and those logs are searchable by anyone. Searching yours returns every certificate ever issued for your domain and its subdomains, with the issuing authority and the names covered. It is a view of your certificate estate assembled from the outside, independent of whatever inventory you keep.
Why run it
Two very different reasons. The first is inventory: the logs know about certificates your records do not, issued by a team that used a different provider or for a service nobody documented. The second is detection — an unexpected certificate for your domain means someone passed a validation check they should not have, which is worth knowing about immediately. There is also a fact worth internalising: because the logs are public, every subdomain you request a certificate for is publicly announced. Attackers enumerate subdomains this way, and so should you.
Why automate it
The security value here is entirely in latency. A mis-issued or unauthorised certificate matters in the hours after it appears, not whenever someone next thinks to look. Monitoring the logs on a schedule turns them from an occasional audit into a genuine alarm, and it is a rare security control with no cost to the thing it protects — you are reading a public log, not touching your infrastructure. It also keeps the inventory current as teams issue certificates without telling you.
What it gives you
An outside-in view of your certificate estate that no internal inventory can match, plus early warning of issuance you did not authorise. The subdomain enumeration it enables is being done to you already; this is how you see the same picture.