While it's not a mitigation, something you should consider doing is using a certificate transparency[0] monitor[1] for your domains. I use the crt.sh service t

While it's not a mitigation, something you should consider doing is using a certificate transparency[0] monitor[1] for your domains. I use the crt.sh service to monitor my domains. It provides RSS feeds (e.g. [3]) that you can hook up to your own monitoring infrastructure. I have this piped into a slack channel, so that any time a certificate is issued, I get a warning. Since I am using LE for certs, I will often cross-reference that issuance with the logs from our LE refresh bot. A future step would be to do that automatically, but this is sufficient for now. [1] https://www.certificate-transparency.org/ https://www.certificate-transparency.org/ [2] https://crt.sh https://crt.sh [3] https://crt.sh/?q=%25.ycombinator.com https://crt.sh/?q=%25.ycombinator.com