Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If we wanted to know if a particular domain has had SSL certificates issued to it by CAs in the past, that are now revoked/expired, is there is a resource that has that information?

share|improve this question
up vote 4 down vote accepted

Probably not.

Firstly, from a privacy point of view:

  • If you're not the legitimate owner of this domain name, the owners could have firewalled you out of their server. It's none of your business to know whether or not they have a certificate for a host, one of its CNAME aliases or anything like that. I would consider a CA leaking that sort of information to be releasing private data to a degree (not in the sense of public/private key).
  • If you are the owner of the service, well, you should have kept better records perhaps. For similar reasons, the fact you are now in control of a domain name doesn't mean that you were its owner a couple of years ago, for example.

This being said, assuming that this is about a host that's publicly visible, you may be able to query the notaries used by systems like Convergence to help you find a number of certificates that may have been valid for a host name, but not necessarily all of them.

It's still possible to have multiple certificates, from multiple CAs (commercial or internal), all valid at the same time. The fact that one users sees a valid certificate from a particular CA doesn't mean that another won't see another certificate, also valid, from the same or another CA. This can happen on large sites (that would use DNS load-balancing, for example), as illustrated in this Security.SE question.

In addition, anyone ca issue a certificate for any host. I can issue a certificate for google.com using a few OpenSSL commands in 2 minutes. No hacking involved. The problem is that I'll be the only one recognising that certificate as valid.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.