Find forgotten subdomains and expiring certificates

You know the certificate on your main website. But how many other hostnames under your domain have one? app, api, staging, mail, auth, a test server somebody set up two years ago?

Every one of them has an expiry date. The ones you forgot are the ones that expire without anybody noticing.

Here is how to find them all for free, what the method cannot see, and how to keep watching the dates.

Certificate Transparency: the public list of every certificate

When a certificate authority issues a public TLS certificate, it writes it to public, append-only logs. These are called Certificate Transparency (CT) logs. Browsers expect new certificates to be in them, so in practice almost every certificate on the public internet is listed.

That gives you a way to ask a simple question: which hostnames under my domain have a certificate? You do not need access to any server. You only search the logs.

Two free search services read the logs: crt.sh and Cert Spotter. Search for %.yourdomain.com and you get every name that appeared on a certificate for it, with the issuer and the dates.

What you will probably find

• Hostnames nobody remembers. A staging site, an old marketing tool, a vendor you connected once for email or login.
• Certificates that are about to expire. Each has a hard end date, and automatic renewal fails more often than people admit: a DNS change, a moved server, an expired token.
• Names that point at nothing. A subdomain whose DNS record still exists after the service behind it was shut down can be taken over by somebody else. Finding the name is the first step to cleaning it up.

What the logs cannot see

It is a good method, not a complete one. Be aware of three limits:

1. Wildcard certificates. A certificate for *.yourdomain.com covers every subdomain but lists none of them, so you cannot tell which names exist.
2. Private certificates. Hosts that use an internal certificate authority are not in the public logs.
3. Hosts without a certificate. If a name serves plain HTTP, or nothing, it will not show up.

So treat the list as "everything with a public certificate", not "everything you own".

Why certificate dates matter more now

The maximum lifetime of a public certificate is getting shorter. The CA/Browser Forum has agreed to step it down in stages: 200 days from March 2026, 100 days from March 2027 and 47 days from March 2029. Shorter certificates mean more renewals, so more chances for one to fail without anybody noticing. Manual tracking in a spreadsheet will not keep up.

The other half: look-alike domains

While you are looking at your domain from the outside, check one more thing: look-alike domains. These are typo versions of your name that someone else has registered, for example a missing letter, two letters swapped, a neighbouring key, a character that looks like another, or the same name with a different ending.

A registered look-alike is not automatically malicious. Many are parked, or bought by the owner as protection. But if one has mail set up, it can send email that looks like it comes from you. That is how a lot of phishing starts, so it is worth knowing they exist.

You can find them without touching them: ask DNS whether each variant exists. That is what we do. We never connect to the look-alike itself.

How StackClock does this

The free domain check takes a domain and shows:

• when the registration expires and when the TLS certificate expires,
• subdomains with valid certificates, found in the CT logs,
• look-alike domains that are registered, and whether they can receive mail.

No sign-up is needed. The free check shows a few results from each list. The look-alike part tests the most likely typo variants, so the real number can be higher.

To keep watching, start free and add your domain to a workspace:

1. Use Find certificates on the domain. We search the CT logs for you.
2. Approve the hostnames you want tracked. Each becomes a TLS certificate asset with its own expiry date. A name you dismiss is never suggested again.
3. We re-check weekly while the domain is tracked, and email you 60, 30, 14, 7 and 1 days before anything expires.

On the Pro and Team plans we also scan for look-alike domains every week and list what we find on your Assets page. One honest limit: we do not send alerts for look-alikes yet. They show on the Assets page only.

The Free plan covers up to 5 assets. See pricing for the rest.

Start with one search

Even if you never sign up, do this today: run your main domain through the free check and read the list of subdomains. If a name surprises you, you just found something worth looking at.

If you want the dates to remind you before they hit, we do that part. It is the same idea as in the deadlines that break production: put every date in one place, with an owner, and get warned early.