Certificate Transparency
Every certificate
leaves a scent.
Public CT logs record every certificate an authority issues, in the open. Give the wolf a domain and it will sniff out the hostnames it exposes and every certificate behind them.