Certificate Inventory by Hostname: Finding Forgotten Domains Before They Lapse
Most small site teams think of SSL as one certificate for one domain. In practice, a website often answers to more names than anyone remembers: the bare domain and the www version, a blog subdomain added years ago, a staging copy someone pointed at a public address, an old landing page still linked from a printed flyer, and perhaps a payment or login host run by a third-party tool. Each of these hostnames either has a certificate or doesn't, and each has its own expiry date. The failure mode is rarely the main site expiring on schedule. It is the forgotten hostname that stops presenting a valid certificate, so visitors see a browser warning on a page you assumed nobody used. This article describes a method for building a hostname inventory before the next renewal cycle, so that SSL hygiene starts from a complete list rather than from memory.
Start With What the Public Internet Sees
Your records of hostnames are almost certainly incomplete, so begin with evidence from outside your own memory. Search your DNS zone records for every A, AAAA, CNAME, and MX entry that points at infrastructure you control. Then check your web server configuration for every server name, virtual host, and redirect rule. Finally, review your analytics and server access logs over a long window, perhaps the last twelve months, and list every hostname that actually received requests. Logs are especially valuable because they reveal legacy addresses that still attract traffic from bookmarks, email signatures, and search results.
For each hostname you find, record the purpose in one sentence, the owner or the person who last changed it, and whether it is meant to be public. A staging host that is intentionally restricted needs a different answer from a public subdomain that merely fell out of use. Keep the inventory in a plain spreadsheet or document that someone other than the original setup person can read. The goal at this stage is completeness, not perfection; you can classify and prune later.
Record the Certificate Behind Each Name
Once you have the list, check what each hostname actually presents. Open each address in a browser and inspect the certificate details, or use a command-line TLS check that reports the subject names, issuer, validity start, and expiry date. Pay attention to the Subject Alternative Name list, since a single certificate may cover several hostnames, and a hostname missing from that list will produce a mismatch error even if the certificate looks valid for the main domain.
Add three columns to your inventory: the certificate covering the name, its expiry date, and the renewal method. Renewal method matters because it determines what breaks silently. A certificate renewed automatically by a hosting control panel is different from one installed by hand from a file that someone downloaded two years ago. Note whether each certificate is shared across hostnames or dedicated to one, and whether the hostname resolves to a server that even has the certificate installed. Many expired-certificate incidents come from hostnames that point at a server nobody renewed for, not from a renewal that failed.
Questions to Ask About Every Hostname
A list of names becomes useful when you ask concrete questions of each entry. Is this hostname still needed, or can it be redirected permanently to a current address? Who is expected to notice if it breaks? Does any external system, such as an email campaign, partner integration, or third-party embed, depend on it? If it redirects, does the redirect itself travel over HTTPS, or does the first hop happen on plain HTTP and expose visitors to a downgrade on the way?
Ask also whether any hostname serves content that a visitor might submit information to. A forgotten form or login page on an old subdomain can be more sensitive than the homepage, and its certificate status deserves the same attention. Finally, ask whether anyone has the access needed to renew or replace each certificate today. If the honest answer is that only a departed contractor could do it, record that as a risk to resolve before renewal day arrives.
A Short Checklist for Your First Pass
Work through these steps in order. First, export every DNS record for your domains and mark which ones point at infrastructure you run. Second, list every virtual host and redirect rule on your web servers or control panel. Third, pull hostnames from the last year of logs and add any that are missing. Fourth, check each hostname's presented certificate and record its covered names and expiry date. Fifth, classify each entry as active and needed, active but legacy, or retire. Sixth, for every legacy entry, decide between redirecting it, removing it, or documenting why it stays. Seventh, assign one named owner for each certificate and confirm that owner can renew it.
Repeat this inventory on a fixed schedule, such as every quarter, and whenever someone adds a campaign page, a new subdomain, or a third-party tool. The inventory only protects you while it stays current, so treat it as a living record rather than a one-time cleanup. A complete hostname list also makes every later decision easier, from choosing how to renew certificates to deciding whether an old address deserves to exist at all.