Which of your addresses does your site certificate cover?

The certificate coverage check compares the addresses public certificate logs list for your domain with the addresses your site certificate covers. The difference is usually normal, and each extra address still needs an owner.

What does this check look at?

It looks at how the names public certificate logs list for your domain compare with the names your site certificate covers. Every new certificate is published in public logs, so a new site shows up within minutes of going live. Attackers read the same logs to list your addresses.

Pulse and Deep scans both run it. It reads public records about your domain and never touches your site. It applies only when public certificate history for the domain could be read.

What does a result mean?

Names outside the certificate usually belong to other services, so a difference does not show a problem on its own. Nothing outside the certificate is contacted. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

How serious is a finding?

Treat this as a hardening gap. It makes an attacker’s job easier but gives them no path of its own, so fix it after anything more direct. Confidence starts at medium, because it rests on public records rather than a response from your site. The report lists what to fix by how directly someone could use it, not by the severity label.

What does a confirmed finding have to show?

Which standards does it relate to?

Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.

Fix it with your AI

This is an inventory task, and an AI with access to your DNS settings can do most of it.

Here is a list of addresses on my domain that appear in public certificate logs but are not covered by my main site certificate: [paste the addresses from the report]. For each one, tell me what service it points to in my DNS records, whether I still use it, and suggest which records I can delete. Do not delete anything yourself.

How to check

Say Atlas, our example app at atlas.example, has a certificate for the main site, while the logs also list a status page and an old shop. The check lists both so someone can confirm they are still wanted.

Run a Pulse scan from your Lockpick account to see it for your site. Pulse or Deep explains what each scan reads, and the full list of checks shows the rest.