Can I remove my certificate from a CT log?

No. CT logs are immutable by design — once a certificate is logged, the record stays public permanently, even after the certificate expires or the subdomain is deleted.

Why do internal subdomains show up in CT search?

Any subdomain that was ever issued a publicly trusted TLS certificate is logged, regardless of whether it was meant to stay internal. DNS privacy does not protect against this — only never requesting a public certificate for it does.

What Is Certificate Transparency?

Every publicly trusted TLS certificate issued since 2018 has to be logged in a public, tamper-evident record before browsers will accept it. That record is searchable — and it often reveals more about a domain than its owner intended.

What CT Logs Are

Certificate Transparency (CT) logs are append-only, cryptographically verifiable logs run by multiple independent operators (Google, DigiCert, Sectigo and others). When a certificate authority issues a publicly trusted certificate, it submits it to one or more of these logs and receives a Signed Certificate Timestamp (SCT) proving the submission happened. Chrome and other major browsers refuse to trust a certificate that doesn't carry a valid SCT.

Why CT Logs Exist

Before CT, a compromised or careless certificate authority could issue a certificate for your domain without you ever finding out — the first sign of trouble might be a phishing site with a perfectly valid, browser-trusted certificate. CT makes every issuance public and permanent, so a domain owner (or anyone monitoring on their behalf) can search the logs and catch unauthorized certificates.

What a CT Search Reveals

Searching CT logs for a domain returns every subdomain that has ever had a publicly trusted certificate issued for it — including wildcard certificates, short-lived certificates from automated issuers like Let's Encrypt, and subdomains that were only ever meant to be temporary. This makes CT search one of the most reliable ways to discover a domain's real subdomain footprint, since it doesn't depend on the domain being willing to answer DNS queries about it.

The Trade-Off: Permanent and Public

CT logs cannot be edited or removed from after the fact — that immutability is the entire point. This means a certificate issued for staging-internal.example.com or admin-panel.example.com stays publicly searchable forever, even if the subdomain is later deleted. Treat CT logs as a fact of life: never assume a hostname is private just because DNS for it isn't publicly enumerable — if it ever had a public TLS certificate, it's in the log.

Search Certificate Transparency Logs

Search CT logs →Next: Subdomain enumeration →

Try it on your domain

See the theory in practice — run a Certificate Transparency Search for your own domain.