Your files stay on your device

Certificate transparency search

Every certificate the public CT logs recorded for a domain: issuers, SANs, validity windows, renewal spacing.

Every certificate the public logs recorded
The search asks crt.sh for each certificate transparency log entry that names the domain, then sums issuers, subject alternative names, validity windows, and the spacing between issuances. Unreachable reads say so instead of pretending the domain has no certificates.

This queries crt.sh's public JSON API from your browser; the queried domain itself is never contacted, and nothing leaves except the one request. Certificate transparency only records what certificate authorities submitted to public logs, so certificates from misissued-or-hidden private logging, and everything issued before public CT logging became the norm around 2018, will not show up. An unreachable crt.sh reads as unknown on purpose: no answer is not the same as no certificates. High-cardinality domains (wildcard hosts with thousands of unique names) are cut at 1000 distinct certificates, most recent first, and the result says so. Expiry is judged against your device clock at search time; revocation is not checked, and a currently-listed certificate can still be revoked. crt.sh is a free community service and can be slow or rate-limit; when it does, the answer stays unknown rather than empty.
OptionsSearch CT logs

More network tools

- Certificate & CSR (/web/certificate)
- RDAP lookup (/network/rdap)
- Live DNS lookup (/network/dns)
All network tools (/network)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/network/certificate-transparency-search
Markdown version: https://nutter.tools/network/certificate-transparency-search.md
Plain-text version: https://nutter.tools/network/certificate-transparency-search.txt
Agent index: https://nutter.tools/llms.txt