How to See the SSL Certificate History of a Domain

If a website has an SSL certificate, then some instance must have published it. Those instances can be queried for past certificates for a given domain.

This is exactly what https://crt.sh/ does.

It allows you to see all certificates that a page has issued before. This is of course also working for internal pages as the issuers do not differentiate between internal and external. website=website

Which is why hiding something behind a subdomain never really works. Instead, you should try to implement good security standards that allow you to secure your websites.