Symantec presently give you the option to redact the labels on precertificates. I think they are the only ones because RFC 6962 does not actually support redac

Symantec presently give you the option to redact the labels on precertificates. I think they are the only ones because RFC 6962 does not actually support redaction. Symantec say they are only submitting these entries to the deneb.ws.symantec.com CT log, but it is possible to cross-post redacted log entries to other CT logs, which actually is happening and is kind of annoying. You can see an example of a redaction (for nsw.gov.au) here: https://crt.sh/?id=49265178 https://crt.sh/?id=49265178 I think the best way to protect your privacy currently is to purchase wildcards, though LE will support wildcards next year :) ! Kind of related, I also wrote https://ausdomainledger.net/ https://ausdomainledger.net/ a couple of weeks ago that is crawling CT logs and Common Crawl as well to enumerate domains in the .au zone, because the zone file is not accessible for the ccTLD.