Certificate Search: Audit CT Logs for Domains
Search the global Certificate Transparency logs to discover all SSL/TLS certificates issued for a domain. Essential for subdomain discovery and security auditing.
📖 Learn more: Understanding Certificate Transparency logs
What is Certificate Transparency (CT)?
Certificate Transparency (CT) is an open framework for monitoring and auditing SSL/TLS certificates. When a Certificate Authority (CA) issues a certificate, it is logged in a publicly accessible, append-only CT log. This allows domain owners to monitor for unauthorized certificates and helps security researchers track CA activity.
🔍 Discover Subdomains
CT logs are one of the most effective ways to find hidden subdomains that have had certificates issued to them.
🛡️ Security Auditing
Monitor for potentially fraudulent certificates issued in your domain's name without your knowledge.
📜 Historical View
View the entire history of certificates issued for a domain, including expired and revoked ones.
How to Search Certificate Transparency Logs
- Enter a domain name such as
example.com. - Click Search Logs. The tool queries the public crt.sh index of Certificate Transparency logs.
- Review each certificate's issuer, the names it covers and its validity dates.
- Look for certificates you did not request, issuers you do not use, or subdomains you did not know were public.
What to Do With CT Search Results
Investigate unexpected certificates
A certificate you did not order might come from a CDN, SaaS platform or hosting provider acting for you, but it can also signal a compromised account or DNS record. Find out who requested it, and ask the issuing CA to revoke it if it was unauthorised.
Restrict which CAs can issue for you
Publish a DNS CAA record listing only the Certificate Authorities you use. CAs must check CAA before issuing, which blocks most unauthorised issuance. Our CAA records guide shows how.
Audit your attack surface
Every subdomain in CT logs is public knowledge. Retire staging, test and forgotten hosts you no longer need, and make sure the rest are patched and monitored.
Frequently Asked Questions
What is Certificate Transparency (CT)?
Certificate Transparency is a public system of append-only logs that record every publicly trusted SSL/TLS certificate. Browsers such as Chrome and Safari require certificates to be logged, so anyone can audit which certificates exist for a domain.
Can I find subdomains with this tool?
Yes. Searching CT logs is one of the most effective ways to discover subdomains, because any subdomain that has had a publicly trusted certificate issued appears in the logs, even if it is not linked anywhere.
Why are there so many certificates for my domain?
Certificates are renewed regularly, and services such as CDNs and hosting platforms may issue their own. With lifetimes of 200 days or less, a single site can accumulate dozens of entries over a few years.
Does a certificate in CT logs mean it is still in use?
No. The logs keep expired and replaced certificates permanently. To see the certificate a server is using right now, run the SSL Checker.
Where does the data come from?
Results come from crt.sh, a public search engine operated by Sectigo that indexes the major Certificate Transparency logs.