SSL certificate issued that I didn't request: what to do

Every public certificate is published in Certificate Transparency (CT) logs, so you can see every certificate issued for your domain, including ones you didn't know about. Most surprises turn out to be a service you use. A few are a sign that someone else controlled a name of yours long enough to get one.

Step 1: read the certificate

Find it on crt.sh or with the certificate finder and note:

The names (Subject Alternative Names) it covers.
The issuer: Let's Encrypt, Google Trust Services, Sectigo, DigiCert, SSL.com and so on.
The dates.

Two entries with the same names and dates are usually one certificate: CAs log a "precertificate" first and the final certificate after.

Step 2: look for the ordinary explanations

Your CDN. Cloudflare issues and renews certificates automatically for every domain active on it, from Let's Encrypt, Google Trust Services or SSL.com (Sectigo for backup certificates). If your DNS is on Cloudflare, expect several of these.
A SaaS custom domain. Helpdesks, status pages, website builders and shops get a certificate for help.example.com or shop.example.com the day someone connects the name.
Your hosting or load balancer, issuing when a site or hostname is added.
A colleague, an agency or an MSP setting something up.

Check where the names in the certificate point today (dig CNAME help.example.com). If they point at a service you use, that's very likely the answer.

Step 3: when it's not explained

Be concerned if the certificate:

names a host that points at a service you no longer use: someone may have claimed it. See subdomain takeover;
names a host you've never used, or a wildcard you didn't ask for;
appeared just after a change you didn't make to your DNS or registrar account. See nameservers changed without permission.

A CA can only issue after the requester proved control of the name, through DNS, a file on the web server or email. A certificate you can't explain means someone had that control: find out how and close it first, or they'll simply get another one.

Step 4: get it revoked

You don't need to be the one who ordered it. Every CA must publish how to report misuse or fraud (in section 1.5.2 of its CPS, and on its website). Under the CA/Browser Forum Baseline Requirements, a CA must revoke within 24 hours when domain validation can't be relied on, and must reply to a problem report within 24 hours.

Let's Encrypt lets you revoke yourself: prove control of every name in the certificate from any ACME account, download the certificate from crt.sh and run certbot revoke --cert-path cert.pem. Reports go to [email protected].
Google Trust Services: the contact form at pki.goog.
Sectigo: its report abuse page.
Other CAs: search for the CA's "certificate problem report" page.

Send the crt.sh link, the names, and why you believe the request wasn't authorised.

Step 5: limit who can issue

A CAA record lists the CAs allowed to issue for your domain:

example.com  CAA  0 issue "letsencrypt.org"
example.com  CAA  0 issue "pki.goog"

CAs check it before issuing, so it stops future surprises from other CAs. It doesn't affect certificates already issued, and it must include every CA your services use (for Cloudflare, all of theirs). See CAA records.

Check your domain

The certificate finder lists every certificate in CT logs for your domain. Nameward's monitoring re-reads the logs every 6 hours and adds each newly certified hostname to your domain's certificate list, so an unfamiliar one shows up within hours.

An SSL certificate was issued for my domain that I didn't request