The fine print
How the shop works
YourSSL Shop counts certificates; it does not make, sell or install them. We sell no certificates, issue none, resell none, and show no seals.
Where the count comes from
Browsers only trust a public TLS certificate if it was recorded in Certificate Transparency (CT) logs. Anyone can search those logs. For each stocktake the shop asks crt.sh, Sectigo's free CT search, for every certificate logged for your domain and its subdomains. It then asks Cert Spotter by SSLMate for the certificates still in date and adds any that crt.sh has not listed yet (crt.sh sometimes lists new certificates late). When crt.sh does not answer after three tries, Cert Spotter's in-date list is used alone, and the sheet says so. Cert Spotter is asked at most 8 times an hour by the whole shop; a sheet made without it says so too. A pre-certificate and its final certificate are counted once. Counts are kept for 6 hours and shared, so the same domain is not fetched twice in that time.
How a label is chosen
Each name takes the label of its newest logged certificate. The rules are on Shelf life. A label is a reading of the public record, not a test of your website: a name can be in the logs and not in use any more.
The counter check
Only when you press "Check the counter" on a name, the shop looks the name up in DNS and opens one TLS connection to it on port 443, reads the certificate the server sends, and closes the connection. It never connects to private or reserved addresses, or to WeldonPC's own server network, and each name can be checked at most 20 times an hour across the whole shop.
CAA
The shop reads the domain's CAA record (RFC 8659) through its own DNS resolver and compares it with the authorities that issued in the last 365 days. The identifiers it uses come from each authority's own documentation. It never changes your DNS.
Limits
Free: 6 stocktakes and 12 counter checks a day. Shop Pass: 40 and 60. The whole shop asks crt.sh at most 400 times a day and Cert Spotter at most 8 times an hour, one query at a time, to stay a polite user of free public services.
Who runs it
YourSSL Shop is run by WeldonPC (weldonpc.com). It is not part of, or endorsed by, Sectigo, SSLMate, any certificate authority or the CA/Browser Forum. Its sister site, YourSSL Outlet, fixes certificate chains for one server.