SSL & Security
Certificate Transparency Checker
Search CT logs
Tool features
4 checks
CT Log Search
Query crt.sh to find all certificates ever issued for a domain
Subdomain Discovery
Find subdomains disclosed in SSL certificate SAN fields
Expiry Status
See active, expiring, and expired certificates at a glance
CSV Export
Download the full certificate list as a CSV file
What is Certificate Transparency & how it works
Certificate Transparency (CT) is a public, append-only log system that every trusted Certificate Authority must submit issued TLS certificates to. Browsers require this, which means anyone can see the full history of certificates issued for a domain — a powerful way to detect mis-issuance.
This tool queries the CT logs (via crt.sh) for a domain and, optionally, its subdomains. It lists every logged certificate with its issuing CA, validity window and covered names, flags issuers that aren't on the well-known-CA list, and surfaces subdomains disclosed in certificate SAN fields.
CT log
A public, tamper-evident record of every certificate a CA issues.
SAN
Subject Alternative Names — the hostnames a certificate covers.
Uncommon CA
An issuer not on our well-known list — worth confirming you requested it.
How to use this tool
1
Enter a domain
Type a domain, e.g.
example.com — a full URL or wildcard is cleaned automatically.2
Choose subdomain coverage
Leave “Include subdomains” on to also find certificates issued for *.example.com hostnames.
3
Search the logs
Click Search Certificates to query public CT logs for every certificate ever issued.
4
Review the findings
Check the issuing CAs, spot uncommon issuers or expiring certs, and export the full list as CSV.
Related tools
4 tools
SSL Checker
Comprehensive SSL certificate analysis including validity, expiration, chain verification, TLS versions, and security assessment
SSL Expiration Checker
Check SSL certificate expiration dates and get alerts before certificates expire
Certificate Decoder
Decode and analyze SSL certificate contents, properties, and metadata in detail
SSL Scanner
Advanced SSL/TLS security scanner with comprehensive vulnerability assessment and configuration analysis
Frequently asked questions
5 Q&A
By reviewing the certificates logged for your domain you can spot mis-issuance — a certificate you didn't request from a CA you don't use — which can be an early sign of compromise or a rogue CA.
Yes. Certificates list every hostname they cover in the SAN field, so CT logs are a rich source of subdomain discovery. Enable “Include subdomains” to surface them.
It means a certificate was issued by an authority not on our well-known-CA list. It isn't necessarily malicious, but you should confirm that you or your provider requested it.
Publish CAA DNS records naming the CAs allowed to issue for your domain. Compliant CAs check CAA before issuing, which blocks unauthorised issuance. Our CAA Lookup tool can verify your policy.