def find_and_persist_domains_where_cert_is_deployed(certificate, excluded_domains, commit,
                                                    timeout_seconds_per_network_call):
    """
    Checks if the specified cert is still deployed. Returns a list of domains to which it's deployed.

    We use the serial number to identify that a certificate is identical. If there were multiple certificates
    issued for the same domain with identical serial numbers, this could return a false positive.

    Note that this checks *all* configured ports (specified in config LEMUR_PORTS_FOR_DEPLOYED_CERTIFICATE_CHECK)
    for all the domains in the cert. If the domain is valid but the port is not, we have to wait for the connection
    to time out, which means this can be quite slow.

    :return: A dictionary of the form {'domain1': [ports], 'domain2': [ports]}
    """
    matched_domains = defaultdict(list)
    # filter out wildcards, we can't check them
    for cert_association in [assoc for assoc in certificate.certificate_associations if '*' not in assoc.domain.name]:
        domain_name = cert_association.domain.name
        # skip this domain if excluded
        if not any(excluded in domain_name for excluded in excluded_domains):
            matched_ports_for_domain = []
            for port in current_app.config.get("LEMUR_PORTS_FOR_DEPLOYED_CERTIFICATE_CHECK", [443]):
                start_time = time.time()
                status = FAILURE_METRIC_STATUS
                match = False
                try:
                    parsed_serial = parse_serial(get_certificate_via_tls(domain_name, port,
                                                                         timeout_seconds_per_network_call))
                    if parsed_serial == int(certificate.serial):
                        matched_ports_for_domain.append(port)
                        match = True
                        current_app.logger.warning(f'Identified expiring deployed certificate {certificate.name} '
                                                   f'at domain {domain_name} on port {port}')
                    status = SUCCESS_METRIC_STATUS
                except Exception:
                    current_app.logger.info(f'Unable to check certificate for domain {domain_name} on port {port}',
                                            exc_info=True)
                elapsed = int(round(1000 * (time.time() - start_time)))
                metrics.send("deployed_certificate_check", "TIMER", elapsed,
                             metric_tags={"certificate": certificate.name,
                                          "domain": domain_name,
                                          "port": port,
                                          "status": status,
                                          "match": match})
            matched_domains[domain_name] = matched_ports_for_domain
            if commit:
                # Update the DB
                cert_association.ports = matched_ports_for_domain
                database.commit()
    return matched_domains

    Checks if the specified cert is still deployed. Returns a list of domains to which it's deployed.

    We use the serial number to identify that a certificate is identical. If there were multiple certificates
    issued for the same domain with identical serial numbers, this could return a false positive.

    Note that this checks *all* configured ports (specified in config LEMUR_PORTS_FOR_DEPLOYED_CERTIFICATE_CHECK)
    for all the domains in the cert. If the domain is valid but the port is not, we have to wait for the connection
    to time out, which means this can be quite slow.

    :return: A dictionary of the form {'domain1': [ports], 'domain2': [ports]}
    
lemur/certificates/service.py