Certificate Transparency Log Search
Every certificate public CAs have issued for a domain, the subdomains they reveal, and what is about to expire. Free, checked live from our server.
About Certificate Transparency Search
Every publicly trusted TLS certificate has to be recorded in public Certificate Transparency logs before browsers will accept it. The logs are append-only and anyone can read them, so together they are a complete history of the certificates issued for any domain.
That makes them useful in three ways. They reveal subdomains, because every name on every certificate is listed — including staging and internal hosts nobody documented. They show which CAs have issued for the domain, so a certificate from a CA you do not use stands out. And they show what is about to expire.
The search asks crt.sh, which indexes every log, and falls back to Cert Spotter when crt.sh is busy, as it often is. Results are deduplicated so a precertificate and its final certificate count once, and names covered by a newer certificate are not reported as expiring.
Where it helps
- Lists every name that has appeared on a certificate for the domain, which is often the fastest way to find forgotten subdomains.
- Groups certificates by issuer, so a CA you do not use is easy to spot, and suggests a CAA record to restrict issuance.
- Warns only about names whose newest certificate is expiring, not about old certificates that have already been renewed.
- Falls back to a second source when crt.sh is overloaded, and says when it has.
Limits
- Only publicly trusted certificates are logged. Certificates from a private or internal CA never appear.
- A wildcard certificate hides the hosts it covers: *.example.com appears, the individual names do not.
- Very large domains return more certificates than can be listed; the newest 500 are shown and the totals cover the rest.
Frequently asked questions
Can someone find my internal hostnames this way?
Yes, if those hosts have publicly trusted certificates. Every name on the certificate is published in the logs the moment it is issued. For hosts whose names should stay private, use a wildcard certificate or a certificate from an internal CA.
What should I do if I find a certificate I did not request?
Contact the issuing CA and ask for it to be revoked, and investigate how someone proved control of your domain — usually through a DNS or web server they had access to. Then publish a CAA record naming only the CAs you use, so others refuse to issue.
Why does the same certificate appear twice elsewhere?
CAs log a precertificate before issuing the final certificate, and both appear in the logs. This search deduplicates them by serial number and issuer, so each certificate is counted once.
Related tools
- SSL Checker — Grade a TLS endpoint and inspect the certificate it serves
- Certificate Expiry Checker — Check expiry dates for up to ten hosts at once
- Certificate Viewer — Decode a PEM certificate or CSR in the browser
- DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
- Certificate Chain Validator — Walk the served chain and flag ordering and trust problems
- OpenSSL Helper — Build the command, read one somebody sent you, and check a key against its certificate
More SSL & Certificates tools
- SSL Checker — Grade a TLS endpoint and inspect the certificate it serves
- Certificate Chain Validator — Walk the served chain and flag ordering and trust problems
- Certificate Expiry Checker — Check expiry dates for up to ten hosts at once
- Certificate Viewer — Decode a PEM certificate or CSR in the browser
- OpenSSL Helper — Build the command, read one somebody sent you, and check a key against its certificate
- CSR Generator — Generate a key pair and certificate signing request locally
- Self-Signed Certificate Generator — Create a certificate and key for local HTTPS, or a private CA to sign development certificates
- Certificate Converter — Convert certificates between PEM, DER and Base64, unpack .p7b bundles, and put a chain in order