Certificate transparency and subdomain takeover monitoring.
Relvato watches the public certificate logs for certificates issued in your domain's name by an authority you don't use, looks for subdomains that point at services you no longer have, and checks your CAA records will let your next certificate renew.
- ✓No recent certificate from an unfamiliar authority
- ✓No subdomain points at a resource that no longer exists
- ✓CAA allows your certificate authority to renew
Every certificate issued anywhere is published in Certificate Transparency logs — so a certificate you didn't ask for is often the first sign that someone controls one of your subdomains or your DNS. The usual way in is a forgotten record: shop-old pointing at a Heroku app or an S3 bucket you deleted, which anyone can now claim and serve pages from under your name.
- Reads the Certificate Transparency logs (via crt.sh) and flags recent certificates from an authority your domain hasn't used before — renewals from your usual authorities, including the several a CDN rotates between, stay quiet.
- Takes the subdomains from those logs, follows each one's CNAME and flags any that point at something that no longer exists, or at a known service's “nothing here” page.
- Compares your CAA records with the authority that issued your current certificate, so a CAA change that would block the next renewal is caught before renewal day.
Where does it find my subdomains?
From the Certificate Transparency logs — every subdomain that ever had a public certificate is listed there — plus your site's own address.
What if the certificate logs are down?
crt.sh, the public log search, is often slow or unavailable. The check then says so and still checks CAA and your site's own address, instead of failing.
Does it probe my subdomains?
It resolves their DNS and, only for known takeover-prone services, loads the home page once to recognise the service's “nothing here” page. Nothing attack-like is sent.
Put this check on autopilot.
Free forever on one site — every check, 100 runs a month. No card, no sales call.