Today I learned of the existence of crt.sh. I typed one of my domain names into the search box to find out what it returns. I found a lot of certificate entries for domains that I don't recognize, and which appear spammy to me. Many of them use a subdomain of mail. Is this something I should be concerned about? Is there any relevant information I should be looking for?

Note: I use Let's Encrypt for my certificates, and it appears that the other certs are also from them--at least the ones I've looked at.

To answer questions from the comments

  1. There are both recent (current) and historical entries.
  2. There is a mix of precertificates and leaf certificates. There might be others, too, since I haven't examined all of the many entries.
  3. I don't use a CDN, but it's possible that my webhost might do some aggregation since it's a shared host and I'm using the certificate generation tool and cronjob they provide.
  4. It appears that most of the domains I don't recognize are of the form mail.TLD, with "mail" sometimes using a different-language equivalent. So could this have something to do with my email hosting provider?
  • Recent entries or historical ones?
    – schroeder
    Commented Sep 25, 2023 at 14:03
  • Both. I'm looking at one with a timestamp of 2023-09-18, which says it's a precertificate. I don't know what a precertificate is. Commented Sep 25, 2023 at 14:07
  • Please look up terms you don't know: letsencrypt.org/docs/glossary/#def-precertificate
    – schroeder
    Commented Sep 25, 2023 at 14:18
  • I read the definition of a precertificate, but I don't understand them enough to be able to form an informed opinion. There are a lot of entries to go through, but it appears that the majority of the certificates I don't recognize are precertificates. However, I've seen one so far which is still valid which is a leaf certificate. Commented Sep 25, 2023 at 14:29
  • Do you use a CDN? CDNs (e.g. Cloudflare) often create certs with 1000 domains that have nothing in common and use those on their edge servers.
    – Z.T.
    Commented Sep 25, 2023 at 15:12

1 Answer 1


I believe I've discovered the answer. The common denominator for all these domains appears to be that they use Zoho email. Each of the domains I tested resolves to Zoho, so presumably the certificates were created by Zoho to enable their webapp to run on a client's subdomain.

  • Zoho is just an webapp and if it doesn't have access to your DNS zone or similar, it won't be able to make those ACME requests Commented Sep 25, 2023 at 18:14
  • There's more to Zoho than just a webapp. To enable it to process mail on my behalf, I have to point MX records to it. I've also set up a subdomain to host the webapp. Commented Sep 25, 2023 at 19:23
  • Fair point I guess Commented Sep 26, 2023 at 18:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .