# An SSL certificate was issued for my domain that I didn't request Every public certificate is published in Certificate Transparency (CT) logs, so you can see every certificate issued for your domain, including ones you didn't know about. Most surprises turn out to be a service you use. A few are a sign that someone else controlled a name of yours long enough to get one. ## Step 1: read the certificate Find it on [crt.sh](https://crt.sh) or with the [certificate finder](/tools/find-ssl-certificates) and note: - **The names** (Subject Alternative Names) it covers. - **The issuer**: Let's Encrypt, Google Trust Services, Sectigo, DigiCert, SSL.com and so on. - **The dates.** Two entries with the same names and dates are usually one certificate: CAs log a "precertificate" first and the final certificate after. ## Step 2: look for the ordinary explanations - **Your CDN.** Cloudflare issues and renews certificates automatically for every domain active on it, from Let's Encrypt, Google Trust Services or SSL.com (Sectigo for backup certificates). If your DNS is on Cloudflare, expect several of these. - **A SaaS custom domain.** Helpdesks, status pages, website builders and shops get a certificate for `help.example.com` or `shop.example.com` the day someone connects the name. - **Your hosting or load balancer**, issuing when a site or hostname is added. - **A colleague, an agency or an MSP** setting something up. Check where the names in the certificate point today (`dig CNAME help.example.com`). If they point at a service you use, that's very likely the answer. ## Step 3: when it's not explained Be concerned if the certificate: - names a host that points at a service you **no longer use**: someone may have claimed it. See [subdomain takeover](/guides/subdomain-takeover); - names a host you've never used, or a wildcard you didn't ask for; - appeared just after a change you didn't make to your DNS or registrar account. See [nameservers changed without permission](/guides/nameservers-changed-without-permission). A CA can only issue after the requester proved control of the name, through DNS, a file on the web server or email. A certificate you can't explain means someone had that control: find out how and close it first, or they'll simply get another one. ## Step 4: get it revoked You don't need to be the one who ordered it. Every CA must publish how to report misuse or fraud (in section 1.5.2 of its CPS, and on its website). Under the CA/Browser Forum Baseline Requirements, a CA must revoke within 24 hours when domain validation can't be relied on, and must reply to a problem report within 24 hours. - **Let's Encrypt** lets you revoke yourself: prove control of every name in the certificate from any ACME account, download the certificate from crt.sh and run `certbot revoke --cert-path cert.pem`. Reports go to cert-prob-reports@letsencrypt.org. - **Google Trust Services**: the contact form at pki.goog. - **Sectigo**: its report abuse page. - **Other CAs**: search for the CA's "certificate problem report" page. Send the crt.sh link, the names, and why you believe the request wasn't authorised. ## Step 5: limit who can issue A CAA record lists the CAs allowed to issue for your domain: ``` example.com CAA 0 issue "letsencrypt.org" example.com CAA 0 issue "pki.goog" ``` CAs check it before issuing, so it stops future surprises from other CAs. It doesn't affect certificates already issued, and it must include every CA your services use (for Cloudflare, all of theirs). See [CAA records](/guides/caa-record). ## Check your domain The [certificate finder](/tools/find-ssl-certificates) lists every certificate in CT logs for your domain. Nameward's monitoring re-reads the logs every 6 hours and adds each newly certified hostname to your domain's certificate list, so an unfamiliar one shows up within hours. ## Sources - [CA/Browser Forum: Baseline Requirements (4.9.1.1, 4.9.3, 4.9.5)](https://cabforum.org/working-groups/server/baseline-requirements/requirements/) - [Let's Encrypt: Revoking certificates](https://letsencrypt.org/docs/revoking/) - [Let's Encrypt: Policy and legal repository](https://letsencrypt.org/repository/) - [Google Trust Services: FAQ](https://pki.goog/faq/) - [Sectigo: Revocation](https://www.sectigo.com/support/revocation) - [Cloudflare: Universal SSL](https://developers.cloudflare.com/ssl/edge-certificates/universal-ssl/) - [Cloudflare: Certificate authorities](https://developers.cloudflare.com/ssl/reference/certificate-authorities/) - [RFC 8659: CAA](https://www.rfc-editor.org/rfc/rfc8659) - [RFC 6962: Certificate Transparency](https://www.rfc-editor.org/rfc/rfc6962) --- Source: https://nameward.app/guides/certificate-issued-i-didnt-request (updated 2026-10-31)