Every certificate issued is published.
WHAT IT IS
Certificate authorities submit every certificate they issue to public, append-only logs. Browsers check that a certificate appears in these logs before trusting it.
WHY IT EXISTS
So that certificate misissuance can be detected. If an authority wrongly issued a certificate for your domain, it appears in the logs and can be found.
WHAT IT MEANS FOR YOU
Every certificate for your domain is publicly visible, including the hostnames it covers. Subdomain names you considered private are not private if they have certificates.
If you have a staging or admin subdomain whose name you would rather not publish, be aware that issuing a certificate for it publishes the name.
A PRACTICAL USE
You can search the logs for your own domain to see every certificate ever issued for it. An unexpected entry warrants investigation.
PROTECTING STAGING SITES
Do not rely on an obscure subdomain name for privacy. Use directory privacy or IP restrictions instead.
