Today I learned of the existence of crt.sh. I typed one of my domain names into the search box to find out what it returns. I found a lot of certificate entries for domains that I don't recognize, and which appear spammy to me. Many of them use a subdomain of
Note: I use Let's Encrypt for my certificates, and it appears that the other certs are also from them--at least the ones I've looked at.
To answer questions from the comments
- There are both recent (current) and historical entries.
- There is a mix of precertificates and leaf certificates. There might be others, too, since I haven't examined all of the many entries.
- I don't use a CDN, but it's possible that my webhost might do some aggregation since it's a shared host and I'm using the certificate generation tool and cronjob they provide.
- It appears that most of the domains I don't recognize are of the form
mail.TLD, with "mail" sometimes using a different-language equivalent. So could this have something to do with my email hosting provider?