Certificate discovery
A certificate discovery tool that keeps looking.
A certificate discovery tool answers one question: which certificates exist for my domains? It matters because every certificate marks a system someone put online, and one you didn't order may be someone preparing to impersonate you. Attack Surface Scan answers the question continuously from certificate transparency (the public logs every trusted certificate is recorded in), flags anything from a provider you haven't approved, and checks which certificates are actually in use.
No card required to start. Plans from $25/month, flat; first report in minutes.
Why SSL certificate inventory goes stale
Certificates get issued without a ticket
A developer sets up a new server, a software vendor provisions a certificate for your custom domain, a content delivery provider issues one on your behalf. Every one is public, and few of them reach the inventory spreadsheet.
Surprise issuance is a signal
A certificate from a provider you don't use is either a misconfiguration or someone who shouldn't be able to prove control of your name. Either way you want to know the day it appears.
One-off lookups don't watch
Searching the public logs gives you a list for the moment you ran it. It doesn't tell you what appears tomorrow, and on large domains the free search tools can be slow or time out.
Issued is not the same as in use
A renewed certificate that exists in the logs but never reached the server, or a renewal that stalled, only shows up when you compare the logs with what each system actually presents.
How the certificate discovery tool works
Certificate transparency monitoring, pointed at the domains you have verified, with the results feeding straight into the rest of your monitoring.
Public logs read every 15 minutes
New certificates for your verified domains and their subdomains surface within the quarter hour, building an SSL certificate inventory that stays current without anyone re-running a search.
Approved providers and a review queue
Tell Attack Surface Scan which certificate providers you use (it learns most of them from what your systems already present). A certificate from anyone else lands in a review queue and alerts at once, so surprise issuance gets looked at rather than scrolled past.
Discovered systems join monitoring
Names found in the logs are added to monitoring automatically, up to your plan's limit and with an exclusion list, and get the same checks as everything else.
Checks of what's actually in use
Each system's certificate is checked daily on Starter and four times a day on Growth and above, which catches certificates that were issued but never put in place, and renewals that stalled partway through.
The technical detail is in the certificates documentation.
What you can show
A certificate register that maintains itself
Every certificate issued for your names, found from public records rather than self-reporting, for your asset register, an auditor or a client.
How impersonation attempts are handled
Each unexpected certificate, when it appeared and when it was reviewed: a dated answer when an auditor or insurer asks how you would detect someone impersonating your domain.
Certificate discovery vs certificate expiry monitoring
Discovery finds every certificate that exists; expiry monitoring makes sure the ones you use get renewed. Attack Surface Scan does both, and this page is about the first.
Looking for renewal warnings?
Escalating reminders from 30 days out and stalled-renewal alerts are covered on the certificate expiry monitoring page.
Honest limits
Discovery only runs for domains you have verified you own, and the public logs only cover publicly trusted certificates: certificates from your own internal certificate authority never appear there. For a one-off look at any domain, the free attack surface scanner uses the same public data.
Common questions
What is the best SSL certificate discovery tool?
One that reads certificate transparency continuously rather than on demand, tells you which certificates came from unexpected providers, and checks what each system actually uses. Attack Surface Scan does all three for verified domains. Cert Spotter is the closest specialist; the comparison lists where each is ahead.
Is there a crt.sh alternative that monitors continuously?
crt.sh is a free public search of certificate transparency logs, useful for a one-off lookup but manual and sometimes slow or unavailable on large domains. Attack Surface Scan reads the logs every 15 minutes for your verified domains, alerts on new and unexpected certificates, and adds discovered subdomains to monitoring.
How do I choose certificate transparency log monitoring?
Check four things: how often the logs are read, whether you can set approved providers and review unexpected certificates, whether discovered subdomains are monitored or just listed, and whether the tool checks the certificate each system actually uses. Attack Surface Scan covers all four from $25/month.
Is this the same as certificate expiry monitoring?
No. Discovery finds every certificate issued for your domains; expiry monitoring warns before the ones in use lapse. Both are included, and expiry is covered on the certificate monitoring page.
Find every certificate issued for your domains.
Verify your domain and the certificate watch starts with your first check.
Start your 7-day trialNo card required to start. Cancel any time.