Certificate Transparency Log Search

Search publicly logged TLS/SSL certificates via crt.sh to enumerate subdomains and track every certificate ever issued for your domain.

Our Certificate Transparency Log Search queries the public logs that record every publicly trusted certificate, revealing which certificates have been issued for your domain, by which authorities, and for which hostnames.

What is Certificate Transparency?

Certificate Transparency is a public auditing system for the certificate authority ecosystem. Every publicly trusted certificate must be submitted to append-only logs that anyone can search.

It exists because certificate authorities are trusted implicitly by browsers, and that trust has been abused. Certificates have been mis-issued through compromise, coercion and error, and before transparency there was no way for a domain owner to discover that a certificate existed for their name until it was used against them.

Browsers now require evidence of log submission before accepting a certificate, so in practice every valid public certificate appears in the logs. The logs are cryptographically append-only, meaning entries cannot be removed or altered after submission.

A public append-only record of every publicly trusted certificate
Required by browsers since 2018 for certificates to be accepted
Lets domain owners detect certificates they did not request
Entries are permanent and cannot be removed
Also reveals subdomains, since certificates name the hosts they cover

Why Certificate Transparency Matters

Monitoring these logs is how you detect a mis-issued certificate for your domain. A certificate obtained by an attacker — through a compromised DNS account, a takeover of a subdomain, or an error at a certificate authority — appears in the logs whether or not they want it to. That is often the earliest available signal that something is wrong.

The same visibility works in the other direction. Because certificates name the hostnames they cover, the logs are among the most productive sources for subdomain enumeration, and attackers use them exactly as defenders do. Anything you have obtained a certificate for is permanently public.

Detects certificates issued for your domain that you did not request
Often the earliest signal of a DNS or subdomain compromise
Reveals your subdomain inventory to anyone who looks
Records are permanent, so internal hostnames stay disclosed forever
Also reveals lookalike certificates suggesting a phishing campaign

How This Certificate Transparency Search Works

The tool queries public log data for certificates naming the domain.

Validates the domain input against format and SSRF safety checks
Queries certificate transparency log data for matching certificates
Extracts every hostname listed in each certificate
Reports the issuing authority and validity period for each
Highlights the distinct subdomains discovered across all entries

How to Use the Certificate Transparency Search

Enter the domain you want to search
Run the search to query the logs
Review each certificate and the hostnames it covers
Check the issuing authority against the ones you actually use
Investigate any certificate or hostname you do not recognise

Understanding Your Certificate Transparency Results

Each log entry describes one certificate:

Field / Value	Meaning
`Common name and SANs`	The hostnames the certificate covers. The subject alternative names are where subdomain enumeration comes from, since a single certificate often lists many hosts.
`Issuing authority`	Which certificate authority issued it. An unfamiliar authority is worth investigating, particularly if you publish CAA records that should have prevented it.
`Validity period`	When the certificate is valid from and until. Expired entries remain in the logs permanently, since the record is append-only.
`Wildcard certificate`	A certificate for *.example.com. It hides the individual hostnames it covers, which reduces what the logs reveal about your inventory.
`Unrecognised hostname`	A name you do not know. Either a forgotten subdomain or, more seriously, evidence that someone else obtained a certificate for your domain.
`Lookalike domain`	A certificate for a domain resembling yours, issued to someone else. Frequently the earliest signal of a phishing campaign being prepared.

Common Problems & How to Fix Them

Treat this as a potential compromise. Domain-validated issuance requires control of the domain or the hostname, so someone demonstrated that control.

Establish how. Check whether a subdomain was taken over, whether your DNS account shows unexpected changes, and whether any hosting account was compromised. Contact the issuing authority to request revocation, and publish CAA records restricting which authorities may issue for you.

Certificates for internal names such as vpn-admin or db-staging are permanently public once issued, and cannot be removed from the logs.

For genuinely internal services, use a private certificate authority rather than a publicly trusted one, which keeps the names out of the logs entirely. For names already disclosed, assume they are known and secure them accordingly.

CAA is checked at issuance time, so a certificate obtained before you published the records is unaffected. If issuance postdates the CAA record, that is a serious matter.

Verify the issuance date against when you published CAA. If the authority issued in violation of a published CAA record, report it to them and consider reporting to the browser root programmes, which treat this as a compliance failure.

Someone has obtained a certificate for a domain resembling yours, which usually means a phishing site is being prepared or is already live.

Check whether the domain is serving content, report it to the hosting provider and registrar, and submit it to browser threat intelligence programmes. Monitoring the logs for lookalike names is one of the earliest warnings available.

A wildcard certificate covers many hosts without naming them, so the logs reveal only the wildcard itself.

This limits what the logs disclose, which is helpful defensively. Supplement with your own DNS zone export for a complete inventory, which is available to you but not to anyone else.

Best Practices

Monitor certificate transparency logs for your domains continuously
Publish CAA records restricting which authorities may issue for you
Use a private certificate authority for genuinely internal services
Watch for certificates issued to lookalike domains
Use the logs as a subdomain inventory source for your own assets
Review the issuing authority on every certificate you find
Remember every entry is permanent and cannot be withdrawn

Security Recommendations

Treat an unrecognised certificate for your domain as evidence of compromise until explained
Pair certificate transparency monitoring with CAA records — CAA prevents issuance, transparency detects it
Never place internal hostnames in publicly trusted certificates, since the disclosure is permanent
Monitor for lookalike domain certificates, which frequently precede a phishing campaign going live
Investigate certificates issued after a CAA record was published, which indicates an authority compliance failure
Use the logs to audit your own subdomain inventory, since attackers are using the same data

Frequently Asked Questions

A public auditing system requiring every publicly trusted certificate to be submitted to append-only logs that anyone can search. Browsers have required evidence of log submission since 2018, so effectively every valid public certificate appears.

Because certificates name the hostnames they cover, and the logs are public by design. The transparency that lets you detect mis-issued certificates also lets anyone enumerate the names you have obtained certificates for.

No. The logs are cryptographically append-only, which is what makes them trustworthy. Once a hostname appears it is public permanently, even after the certificate expires or is revoked.

Treat it as a potential compromise. Establish how the requester proved control — a subdomain takeover, a DNS account compromise, or an authority error. Request revocation from the issuer and publish CAA records to prevent recurrence.

Use a private certificate authority for internal services. Private certificate authorities are not subject to transparency requirements, so those names never become public. Publicly trusted certificates always appear.

CAA prevents unauthorised issuance by telling authorities to refuse. Certificate transparency detects issuance after the fact. They are complementary — CAA is the control, transparency is the monitoring that catches what CAA missed.

A certificate for *.example.com covers every subdomain without naming any of them, so only the wildcard appears in the logs. This reduces what the logs disclose about your inventory, which is a defensive benefit.