Certificate watch
Every certificate authority has to write issued certificates into public certificate transparency logs. Certificate watch reads those logs and reports every new certificate issued for a name you are watching.
The value is not so much in your own orders, which you know about anyway. It is in noticing a certificate that somebody else had issued for your name.
Where to find it
Section titled “Where to find it”Security → Certificate watch, direct address: dash.regfish.com/my/cert-watch
Adding names
Section titled “Adding names”Under add names you enter a hostname. Three properties matter here and are not obvious everywhere:
- The name does not have to be yours or held at regfish. So you can also watch a spelling somebody might register for phishing.
- Subdomains are included. Watch
example.comand you also hear aboutlogin.example.com. - The first round only sets the baseline. You will not be sent the history after the fact; reporting starts with the next new certificate.
The quota is 50 names, shown as a counter above the list.
What a report means
Section titled “What a report means”A report only says that there is a new certificate for this name. That is normal if you ordered or renewed yourself, if a hosting provider renews automatically, or if a CDN in front of your site issues its own certificate.
Take notice when none of those apply. Then it is worth looking at the issuing authority and the timestamp. If you want to restrict such issuance up front, set a CAA record: it declares which certificate authorities may issue for the domain at all. You add it like any other record, see DNS records.