A certificate issued for a hostname is announced, at the moment it’s issued, into a public and permanent log kept by somebody else, not by whoever requested it. Once an entry is made, it cannot be withdrawn.
What a public log does with a hostname
That single property, an entry can be added but never removed, is enough on its own to make a hostname permanently public, whether or not anyone meant it to be. A name chosen for infrastructure that was never meant to be publicised becomes public the moment a certificate is cut for it, and stays public no matter what happens to that certificate afterward. This isn’t a breach. It’s the log doing exactly what it was built to do.
A name whose issuance has stopped is still a public name
Moving from certificates issued one hostname at a time to a single certificate covering a whole domain stops new entries from being added for the older, individual names. It does nothing to the entries already made. Those names remain in the log, sitting beside whatever replaced them, for good. Reading that log correctly means treating an absence of new individual entries as the sign that the old pattern of issuance had ended. A first reading of it can go the other way, seeing issuance that was still ongoing where, in truth, it had already stopped.
What’s still worth protecting
Once a name already sits in a public log, redacting it from anything written afterward protects nothing, and it costs the writing real substance for no gain. What the log doesn’t hand over, and what still matters, is the meaning attached to a name: its address, the shape of the network, its version, where the secrets live. The rule that follows isn’t to “hide the names”. It’s to “tell the story, never ship the register”. The danger was never any one fact sitting alone; it’s the aggregation. A public log hands out names. It does not hand out the mapping from a name to its purpose, its address, and its role. A table would.
The night this came from, told as it happened, is The log that cannot be taken back.