For a server hosting many domains — a hosting provider's shared server, or an agency managing many client sites — manually issuing and renewing a certificate for each one doesn't scale. Auto-discovery tools handle this by automatically detecting active domains and issuing certificates for each, without a manually maintained list.
cPanel AutoSSL
cPanel's AutoSSL automatically issues and renews free domain-validated certificates for every domain on every account on the server, with zero manual configuration per domain — new domains added to any account are automatically picked up on AutoSSL's next scheduled run.
Custom scripting for non-cPanel environments
On a custom server setup, a script that enumerates active virtual hosts or Nginx server blocks and runs Certbot against each newly discovered domain (checking first whether a valid certificate already exists) can achieve a similar effect — though this requires more setup and maintenance than a built-in tool like AutoSSL provides out of the box.
What to do if a discovery tool reports domains you don't recognize managing
An unrecognized domain appearing in a Certificate Transparency-based discovery tool's results may indicate a subdomain you'd forgotten about, a related but separate domain your organization owns, or in rarer cases, a in practice unauthorized certificate worth investigating further.
How to set up ongoing automated discovery rather than a one-time audit
Several services offer ongoing, automated Certificate Transparency log monitoring with alerts for new certificates matching your domain patterns, turning a one-time manual audit into continuous, automatic awareness of any future certificate issuance across your domain portfolio.
What information a good discovery tool report should include beyond just domain names
A useful discovery report includes not just the domain, but the certificate's issuer, expiry date, and validation level for each discovered entry, letting you assess at a glance which discovered certificates might need attention rather than just knowing they exist.
How to integrate discovery results into your organization's broader asset inventory
Feeding discovered certificate and domain information into whatever broader IT asset management or CMDB system your organization already maintains keeps certificate inventory consistent with your general infrastructure documentation, rather than existing as a separate, disconnected list only you maintain.
Why periodic re-discovery catches new certificates issued since your last audit
Running discovery as a recurring, scheduled process rather than a one-time audit catches new certificates issued for your domains since the last check, whether legitimately by your own team or, in a really concerning case, by an unauthorized party — a single audit only reflects a snapshot at one point in time.
What to do if discovery reveals significantly more certificates than your team expected
A discovery result significantly larger than expected often reflects forgotten subdomains, old marketing campaign domains, or shadow IT infrastructure set up outside normal processes — treating this as a valuable inventory-building exercise rather than a false positive is usually the more productive response.
How to use discovery results to identify certificates nearing expiry across your whole portfolio
Cross-referencing discovered certificates' expiry dates against your monitoring system's alert thresholds surfaces any certificate approaching expiry that isn't already being actively tracked by your standard monitoring, closing a gap between certificates you know about and ones discovery reveals you'd forgotten.
A closing note on discovery as a foundational practice for any organization with many domains
For any organization managing more than a small handful of domains, periodic certificate discovery deserves a place alongside more commonly recognized practices like regular backups and access audits — a foundational, recurring practice rather than an occasional, optional exercise.
Loading comments…