SSL & Security

Certificate Transparency Checker

CT Logs

Search CT logs

Enter a domain to search Certificate Transparency logs for all SSL certificates ever issued.

Tool features

Search public SSL Certificate Transparency logs
4 checks

CT Log Search

Query crt.sh to find all certificates ever issued for a domain

Subdomain Discovery

Find subdomains disclosed in SSL certificate SAN fields

Expiry Status

See active, expiring, and expired certificates at a glance

CSV Export

Download the full certificate list as a CSV file

What is Certificate Transparency & how it works

How public logs expose every certificate issued

Certificate Transparency (CT) is a public, append-only log system that every trusted Certificate Authority must submit issued TLS certificates to. Browsers require this, which means anyone can see the full history of certificates issued for a domain — a powerful way to detect mis-issuance.

This tool queries the CT logs (via crt.sh) for a domain and, optionally, its subdomains. It lists every logged certificate with its issuing CA, validity window and covered names, flags issuers that aren't on the well-known-CA list, and surfaces subdomains disclosed in certificate SAN fields.

CT log
A public, tamper-evident record of every certificate a CA issues.
SAN
Subject Alternative Names — the hostnames a certificate covers.
Uncommon CA
An issuer not on our well-known list — worth confirming you requested it.

How to use this tool

Search a domain's certificates in four steps
1
Enter a domain
Type a domain, e.g. example.com — a full URL or wildcard is cleaned automatically.
2
Choose subdomain coverage
Leave “Include subdomains” on to also find certificates issued for *.example.com hostnames.
3
Search the logs
Click Search Certificates to query public CT logs for every certificate ever issued.
4
Review the findings
Check the issuing CAs, spot uncommon issuers or expiring certs, and export the full list as CSV.

Related tools

Keep debugging with tools from the same suite
4 tools
SSL Checker
Comprehensive SSL certificate analysis including validity, expiration, chain verification, TLS versions, and security assessment
SSL Expiration Checker
Check SSL certificate expiration dates and get alerts before certificates expire
Certificate Decoder
Decode and analyze SSL certificate contents, properties, and metadata in detail
SSL Scanner
Advanced SSL/TLS security scanner with comprehensive vulnerability assessment and configuration analysis

Frequently asked questions

Common questions about Certificate Transparency
5 Q&A

Certificate Transparency is a public logging framework that trusted CAs must submit every issued TLS certificate to. It lets domain owners and researchers detect unexpected or unauthorised certificates.

By reviewing the certificates logged for your domain you can spot mis-issuance — a certificate you didn't request from a CA you don't use — which can be an early sign of compromise or a rogue CA.

Yes. Certificates list every hostname they cover in the SAN field, so CT logs are a rich source of subdomain discovery. Enable “Include subdomains” to surface them.

It means a certificate was issued by an authority not on our well-known-CA list. It isn't necessarily malicious, but you should confirm that you or your provider requested it.

Publish CAA DNS records naming the CAs allowed to issue for your domain. Compliant CAs check CAA before issuing, which blocks unauthorised issuance. Our CAA Lookup tool can verify your policy.