Certificate Transparency Search

Search public Certificate Transparency logs for every certificate issued for a domain, with issuers, subject alternative names, validity windows and renewal patterns.

Uses an external data source

Your search term is sent to the public authority named on this page so the answer reflects current data.

Data source: crt.sh Certificate Transparency search

Domain Searches the public Certificate Transparency logs via crt.sh. Nothing is sent to the domain itself.

Certificate Transparency is a public, append-only record

Every publicly trusted certificate authority is required to submit the certificates it issues to public CT logs, and browsers refuse certificates that are not logged. That makes CT a near-complete public record of what has been issued for any domain - including certificates issued by someone who should not have.

This tool searches that record through crt.sh, which indexes the logs. Note that the query goes to crt.sh, not to the domain you enter - the domain itself is never contacted.

What CT is genuinely good for

Noticing a certificate nobody asked for. An issuance from an authority you do not use is the clearest early signal of a domain takeover or a misissuance. It is the reason CT exists.
Finding forgotten subdomains. Names appear in certificates long after anyone remembers creating them, and a staging or admin host that still resolves is worth knowing about.
Renewal patterns. A gap in issuance where there should be a regular renewal often means automation broke and nobody noticed yet.

What CT results are not

This matters enough to say plainly, because several tools get it wrong: a name in a certificate is not a live host.

Certificates are routinely issued for names that never resolved, for environments decommissioned years ago, and as wildcards covering names that were never used. Presenting a CT search as an asset inventory produces a list that is mostly things which do not exist - and then someone spends a week chasing them.

Treat the output as leads. Resolve anything you intend to act on before acting on it.

Controlling who can issue for your domain

CT tells you after the fact. A CAA record tells the certificate authorities in advance which of them are permitted to issue for your domain at all, and compliant CAs are required to honour it. Publishing one is the preventative control that pairs with CT's detective one - check yours with CAA Lookup.

For ongoing coverage, subscribe to CT monitoring for your domains. Several services will email you when a certificate is issued, which turns this from something you remember to check into something that tells you.

About the data source

crt.sh is a free community service run by Sectigo. It is occasionally slow or briefly unavailable, and when that happens this tool reports unknown rather than "no certificates found" - an unreachable log search tells you nothing about what was issued. No API key is required.

Frequently asked questions

Does this contact the domain I enter?

No. The query goes to crt.sh, which indexes the public CT logs. The domain itself is never contacted, so this is entirely invisible to it.

Are all these subdomains live?

Almost certainly not. A name in a certificate means a certificate was issued for it - nothing more. Many never resolved and many are long decommissioned. Verify before acting.

I see an issuer I do not recognise. What now?

Investigate it, and publish a CAA record naming only the authorities you use. Common innocent explanations are a CDN or hosting provider issuing on your behalf, or a certificate for mail infrastructure.

Why did it return nothing for a site that clearly has HTTPS?

The search matches subdomain patterns. A certificate issued only for the apex with no subdomain names may not match. Try searching crt.sh directly for the apex.

Is an API key needed?

No. crt.sh is free and open, and nothing in this tool requires configuration.

References

Related tools

What this tool can and cannot tell you. It reports what the named source held when it was queried. Where that source has no record, the answer is unknown rather than safe - an absent entry is not evidence of absence.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.