0

Today I learned of the existence of crt.sh. I typed one of my domain names into the search box to find out what it returns. I found a lot of certificate entries for domains that I don't recognize, and which appear spammy to me. Many of them use a subdomain of mail. Is this something I should be concerned about? Is there any relevant information I should be looking for?

Note: I use Let's Encrypt for my certificates, and it appears that the other certs are also from them--at least the ones I've looked at.

To answer questions from the comments

  1. There are both recent (current) and historical entries.
  2. There is a mix of precertificates and leaf certificates. There might be others, too, since I haven't examined all of the many entries.
  3. I don't use a CDN, but it's possible that my webhost might do some aggregation since it's a shared host and I'm using the certificate generation tool and cronjob they provide.
  4. It appears that most of the domains I don't recognize are of the form mail.TLD, with "mail" sometimes using a different-language equivalent. So could this have something to do with my email hosting provider?
Improve this question
8
  • Recent entries or historical ones?
    – schroeder ♦
    Sep 25 at 14:03
  • Both. I'm looking at one with a timestamp of 2023-09-18, which says it's a precertificate. I don't know what a precertificate is.
    – Scott Severance
    Sep 25 at 14:07
  • Please look up terms you don't know: letsencrypt.org/docs/glossary/#def-precertificate
    – schroeder ♦
    Sep 25 at 14:18
  • I read the definition of a precertificate, but I don't understand them enough to be able to form an informed opinion. There are a lot of entries to go through, but it appears that the majority of the certificates I don't recognize are precertificates. However, I've seen one so far which is still valid which is a leaf certificate.
    – Scott Severance
    Sep 25 at 14:29
  • Do you use a CDN? CDNs (e.g. Cloudflare) often create certs with 1000 domains that have nothing in common and use those on their edge servers.
    – Z.T.
    Sep 25 at 15:12

1 Answer 1

Reset to default
1

I believe I've discovered the answer. The common denominator for all these domains appears to be that they use Zoho email. Each of the domains I tested resolves to Zoho, so presumably the certificates were created by Zoho to enable their webapp to run on a client's subdomain.

Improve this answer
3
  • Zoho is just an webapp and if it doesn't have access to your DNS zone or similar, it won't be able to make those ACME requests
    – Sir Muffington
    Sep 25 at 18:14
  • There's more to Zoho than just a webapp. To enable it to process mail on my behalf, I have to point MX records to it. I've also set up a subdomain to host the webapp.
    – Scott Severance
    Sep 25 at 19:23
  • Fair point I guess
    – Sir Muffington
    Sep 26 at 18:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .