Many people are surprised to discover that a newly created subdomain that has not been advertised anywhere (for example, teszt.pelda.hu or fejlesztes.pelda.hu) is already receiving visitors – and even attack attempts – just a few minutes after it has been created. The reason for this is Certificate Transparency (CT).

What is Certificate Transparency?

Certificate Transparency is a public logging system: every SSL certificate accepted by browsers must be logged in several independent public logs upon issuance. Chrome and Safari do not accept certificates that are not logged in these logs, so virtually all certificates are now public.

The purpose of the system is to detect instances where a certificate authority issues a certificate for a domain without authorisation, whether by mistake or intentionally. Anyone can view the logs, so such certificates cannot remain hidden.

What does this tell me about my subdomains?

As the certificate covers all domains and subdomains for which it is valid, anyone can use the logs to list all subdomains of a domain for which a certificate has ever been issued. To do this, simply enter %.pelda.hu into the crt.sh search engine.

On our cPanel hosting plans, AutoSSL automatically requests a certificate for every subdomain, so the name of every subdomain is recorded in the logs.

This is not a security vulnerability in itself: the logs only contain names, not the content of the website. However, there are a few things worth bearing in mind:

• The name of the subdomain is no secret. Do not assume that a ‘hidden’ subdomain (such as a test page or an admin interface) will remain hidden. Protect it with a password; see: Protecting a directory with a password in cPanel.
• Do not choose a revealing name. The subdomain name should not contain a customer name, project name or any internal information that you do not wish to disclose.
• Complete installations quickly. Attackers monitor logs and immediately search for incomplete installations on domains with new certificates. They can take over an abandoned WordPress installation in a matter of minutes. If you are installing a new site, complete the installation immediately or password-protect the directory whilst the installation is in progress.

Can subdomains be hidden?

The wildcard certificate (*.pelda.hu) only leaves the entry *.pelda.hu in the log; it does not record the names of individual subdomains. See: What is a Wildcard SSL certificate? Bear in mind, however, that subdomains can be identified from the DNS and other sources; therefore, genuine protection lies in passwords and access restrictions, not in hiding the name.

How can you use this for your own protection?

Certificate Transparency helps you too: you can check whether anyone else has applied for a certificate for your domain.

• Search for your domain on crt.sh and check whether you are familiar with all the certificates issued.
• Certain services (such as Cert Spotter or Cloudflare’s certificate monitor) will notify you by email when a new certificate is issued for your domain.

If you find a certificate that you did not request, please contact our support team. You can protect yourself against unauthorised issuance in future by configuring the CAA record.