Certificate Transparency Search
Enter a domain to see the certificates that publicly trusted certificate authorities have logged for it and its subdomains — who issued them, when, and for which names.
- Security intelligence
- Live check
- Free, no sign-up
- Results are not published
Run Certificate Transparency Search
At a glance
- What it checks
- See certificates publicly logged for a domain and its subdomains: issuers, validity dates and the names they cover.
- Data source
- A public Certificate Transparency search service (crt.sh JSON output).
- Freshness
- Live check; results are cached for up to 6 hours
- Limits
- A logged certificate proves issuance, not that a host exists today; very large domains are limited to the most recent certificates. Methodology
- Cost
- Free, no account needed
Understanding the result
What Certificate Transparency is
Certificate Transparency (CT, RFC 6962) is a public, append-only record of TLS certificates. Browsers only trust a certificate if it has been submitted to CT logs, so practically every publicly trusted certificate issued since 2018 appears in them. Anyone can search the logs, which means a domain owner can see every certificate issued for their names — including ones they did not request.
The search looks for the registrable domain and every name below it, merges the pre-certificate and final certificate of each issuance, and shows the newest certificates first.
What CT can and cannot tell you
- It shows issuance. A logged certificate proves that a certificate authority issued a certificate for those names at that time.
- It does not prove a host exists. A name in a certificate may never have been used, may have been removed from DNS, or may now point somewhere else.
- It does not prove control today. Domains change owners and hosting providers; old certificates stay in the logs forever.
- Validity dates are not revocation status. A certificate inside its validity period may have been replaced or revoked.
Treat CT as a history of issuance, and check the certificate a site actually serves with the SSL Checker.
Reading the findings
- Certificates found counts the distinct certificates after merging duplicates.
- Currently valid counts certificates whose dates include today.
- New certificate authority appears when an authority that had not issued before for the domain issued a certificate in the last 30 days. After a hosting or CDN change this is expected; if nothing changed, look at the certificate and consider restricting issuers with CAA records.
- Wildcard certificates cover a whole level of names, so they do not reveal individual hostnames.
Very large domains have more certificates than one search returns. The result says when it is limited, and the counts describe only the certificates received.
Where the data comes from
Results come from a public CT search service through its documented JSON output, are cached for several hours and are rate-limited so the free service stays usable for everyone. If the service is unavailable, the tool says so instead of showing an empty result. To see which hostnames appear across all certificates, use the Passive Subdomain Finder.
Frequently asked questions
Why is there a certificate I did not request?
Most often a hosting provider, CDN or email service obtained it automatically on your behalf. If none of your providers did, contact the issuing certificate authority and consider adding CAA records that allow only the authorities you use.
Can I remove a certificate from CT logs?
No. CT logs are append-only by design. That permanence is what makes them useful for detecting mis-issuance.
Why are some internal names visible?
Any name placed in a publicly trusted certificate becomes public. Use wildcard certificates or a private certificate authority for names you do not want published.
How current is the data?
Certificates appear in the logs within minutes of issuance, and search services index them shortly afterwards. DomainDNSCheck caches a search for a few hours; the retrieval time is shown under the result.