[Kwpolska]

What if you have a wildcard cert for *.example.com?

[andix]

Much better. But you still leave traces from dns queries.

Subfinder has a lot of sources to find subdomains, not only certs: https://github.com/projectdiscovery/subfinder

[jamesfinlayson]

I worked at a company where the security team disliked wildcard certificates because it exposed us to the risk of someone, somehow, hosting something malicious on a subdomain.