Internal hostnames that never appear in Certificate Transparency

Every TLS certificate you've ever issued for admin.yourcompany.com or staging-payroll.yourcompany.com is in the public Certificate Transparency logs. Attackers don't scan your network for internal tools; they grep crt.sh.

Hoody serves every container URL under a wildcard certificate for *.{server}.containers.hoody.com. Your admin dashboard, your staging payroll system, your on-call runbook: each lives at a URL whose container ID is 24 hex characters of entropy, and none of those hostnames is ever written to a CT log. There is nothing to grep.

The one exception is deliberate: CNAME a custom domain to an alias and that hostname does appear, because you meant to publish it.

Certbot, a reverse proxy config, and a leaked hostname per cert all go away.

The address is the secret, and the certificate doesn't announce it.