Certificate Transparency Search

Certificate Transparency Search: Every Certificate Issued for a Domain

Public certificate authorities must log every TLS certificate they issue in certificate transparency (CT) logs before browsers will trust it. This tool searches those logs through crt.sh and lists the certificates issued for a domain and its subdomains: issuer, issue and expiry dates, serial number and every name (SAN) on the certificate. It also counts how many are still valid and which CAs issued them.

How to Read the Results

• Currently valid / expired: a certificate counts as valid if today is between its issue and expiry dates. Revocation is not checked.
• Issuers: which CAs and intermediate certificates signed them. An issuer you don't recognise can mean a forgotten service, a CDN or a vendor issuing certificates on your behalf; it is worth checking.
• Names: the subject alternative names on each certificate. CT logs are a quick way to discover subdomains, including ones that are no longer in DNS.
• Duplicates: a CA logs a "precertificate" and then the final certificate; both share a serial number and are shown once.

Common Problems

• crt.sh is slow or unavailable: it is a free community service and busy names can take 30 seconds or more. Results are cached here for 6 hours, and after a failure we wait a few minutes before asking again.
• Very large domains: for names with tens of thousands of certificates, crt.sh returns only part of the list, often the oldest entries. Search a more specific name such as www.example.com.
• A new certificate is missing: logs are merged into crt.sh within minutes to a few hours of issuance.
• Unexpected certificates: if you see certificates you did not request, add CAA records to limit which CAs may issue for your domain, and contact the issuing CA.

To inspect the certificate a server is actually using right now, use Check SSL Certificate.