Every certificate issued for your domain becomes a public record. That cuts both ways, and you may as well be the one reading it.
Subscribe a domain and Efflux watches the certificate transparency logs for names that match. The subscription first seeds from the historical logs, so everything already out there is accounted for and stays quiet. After that, a new name is genuinely new.
A name you did not expect is worth a look
A certificate for a subdomain you have never heard of means someone stood something up. Sometimes that is a team shipping without telling you, and sometimes it is a vendor, and occasionally it is neither. Either way, it is a host that exists and is not on your list yet.
Certificates also tend to appear before anything else does. A name shows up in a log when it is provisioned, which is often earlier than it shows up in DNS answers you would notice.
Keep an eye on renewals
The flip side is the certificate you expected and did not get. Watching issuance for your own names tells you when a renewal happened, which issuer did it, and how long the new certificate is good for.
Get it the way you want it
Delivery can be immediate when you want to react, or batched hourly, daily, weekly, or monthly when you would rather read a digest. Point it at a webhook and it lands wherever your team already looks.
Where to go next
Certificate Monitoring covers the subscription, the notification conditions, and how to read matches.