📜

Certificate Transparency Log Search

Search the public Certificate Transparency logs to find every SSL/TLS certificate ever issued for a domain, revealing hidden subdomains.

RFC: RFC 6962, 9162
COVERAGE: Every publicly-trusted cert since 2018
MUTABILITY: Append-only, permanent

What is Certificate Transparency Log Search?

Every publicly trusted SSL/TLS certificate must be logged in a set of public, cryptographically append-only records before browsers will accept it. Searching those logs reveals every certificate — and therefore every hostname — a domain has ever had issued.

How it Works

The tool queries Certificate Transparency log data for entries naming the target domain, extracts every hostname from the certificate common name and subject alternative name fields, and reports the issuing authority and validity window for each match.

Key Use Cases

Discovering forgotten staging or admin subdomains that were never meant to be public.

Detecting a certificate issued by an unfamiliar authority for your own domain — a sign of possible compromise.

Monitoring for certificates issued to lookalike domains as an early phishing-campaign warning.

Advanced Details

Log entries can never be removed once submitted. A certificate issued for an internal hostname by mistake stays permanently searchable, even long after that certificate expires or is revoked — which is why internal names should use a private CA instead of a publicly trusted one.

Cybersecurity Pros & Cons

Security Advantages
  • The only reliable way to detect a mis-issued or attacker-obtained certificate for your own domain.
  • Reveals subdomains through certificate SANs that DNS enumeration alone would never surface.
  • Free, instant, and covers every publicly trusted certificate authority at once.
  • Lookalike-domain certificates often surface here before a phishing site actually goes live.
Security Limitations
  • A wildcard certificate hides every individual hostname it covers from the logs.
  • Log entries are permanent — an internal hostname accidentally certified stays disclosed forever.
  • Attackers use the exact same logs for subdomain reconnaissance, so the visibility cuts both ways.
  • Private-CA certificates for internal services are not covered, so coverage is incomplete by design.
Ready to Test?

Use our professional-grade tool to perform a real-time check for this module.

Run Module Now
Related Docs