# Find all SSL certificates for a domain

Every publicly trusted TLS certificate is published in Certificate
Transparency (CT) logs before browsers accept it. Enter your domain and
Nameward searches those logs for every unexpired certificate covering it or
its subdomains, then connects to the main and most recently certified hosts to see which certificate
each one actually serves.

## Why it's worth looking

- **Forgotten hosts.** Old VPN portals, test servers and vendor-hosted pages
  show up in the logs long after everyone forgot them.
- **Unexpected issuers.** A certificate from a CA you don't use can mean a
  team or supplier set something up without telling you, or something worse.
- **Renewals that never got installed.** If the logs hold a newer certificate
  than the server presents, the renewal is sitting unused: see
  [Certificate renewed but not installed](/guides/certificate-renewed-but-not-installed).

## How to read the results

Each checked host shows its issuer, expiry date and a status. Certificates
now last at most 200 days (falling to 47 days by 2029, see
[47-day SSL certificates](/guides/47-day-ssl-certificates)), so status is
graded against each certificate's own lifetime rather than a fixed number of
days.

If the CT log search is slow or down, the scan says so and still checks the
main hosts, instead of reporting "no certificates".

## Related checks

- [SSL certificate expiry checker](/tools/ssl-expiry-checker) for every host.
- Runbooks for appliances that need manual installs:
  [FortiGate](/guides/fortigate-replace-ssl-certificate),
  [SonicWall](/guides/sonicwall-replace-ssl-certificate),
  [Sophos Firewall](/guides/sophos-firewall-replace-certificate),
  [IIS and Remote Desktop](/guides/iis-rds-replace-certificate),
  [Exchange hybrid](/guides/exchange-hybrid-certificate-renewal).

---
Source: https://nameward.app/tools/find-ssl-certificates (updated 2026-10-30)