Every publicly trusted TLS certificate is published in Certificate Transparency (CT) logs before browsers accept it. Enter your domain and Nameward searches those logs for every unexpired certificate covering it or its subdomains, then connects to the main and most recently certified hosts to see which certificate each one actually serves.
Why it's worth looking
- Forgotten hosts. Old VPN portals, test servers and vendor-hosted pages show up in the logs long after everyone forgot them.
- Unexpected issuers. A certificate from a CA you don't use can mean a team or supplier set something up without telling you, or something worse.
- Renewals that never got installed. If the logs hold a newer certificate than the server presents, the renewal is sitting unused: see Certificate renewed but not installed.
How to read the results
Each checked host shows its issuer, expiry date and a status. Certificates now last at most 200 days (falling to 47 days by 2029, see 47-day SSL certificates), so status is graded against each certificate's own lifetime rather than a fixed number of days.
If the CT log search is slow or down, the scan says so and still checks the main hosts, instead of reporting "no certificates".
Related checks
- SSL certificate expiry checker for every host.
- Runbooks for appliances that need manual installs: FortiGate, SonicWall, Sophos Firewall, IIS and Remote Desktop, Exchange hybrid.