CT Log Search
Search Certificate Transparency logs for a domain's certificates.
Enter a value above to run CT Log Search
e.g. example.com
Quick answer
CT Log Search finds every publicly trusted certificate issued for a domain by searching Certificate Transparency logs, showing issuers, dates, and all covered hostnames. Use it to discover forgotten subdomains and to spot certificates you never authorized, which can signal mis-issuance or compromise.
CT Log Search finds every publicly logged certificate ever issued for a domain by searching the Certificate Transparency logs. You enter a domain and get back the certificates, their issuing CAs, validity dates, and, crucially, all the hostnames they cover. Because every publicly trusted certificate must be logged to be accepted by browsers, these logs are an near-complete public record of who has certificates for your name, which makes them a powerful reconnaissance and security tool.
Certificate Transparency (RFC 6962) was created so that mis-issuance cannot happen in secret. Chrome and other browsers reject any certificate that was not published to append-only, publicly auditable CT logs, so CAs log everything they issue. That transparency has a useful side effect: searching the logs for your domain reveals forgotten subdomains, shadow IT, and any certificate an attacker or rogue CA may have obtained for a name you own.
What Certificate Transparency is
CT is a system of public, append-only logs that record every certificate a CA issues. Each certificate gets a Signed Certificate Timestamp (SCT) proving it was submitted, and browsers require SCTs before they trust a certificate. The logs are cryptographically verifiable and mirrored by monitors like crt.sh, so anyone can audit issuance for any domain. The design goal is that no certificate for your domain can exist without leaving a public trace.
Finding forgotten subdomains
Every certificate lists its Subject Alternative Names, so searching CT for example.com surfaces subdomains you may have forgotten: staging.example.com, old-vpn.example.com, an abandoned marketing microsite. This is one of the fastest ways to map your real external footprint, because it shows names that ever had a certificate even if their DNS is now quiet. Security teams use it as a lightweight asset-discovery pass that needs no access to your infrastructure.
Detecting rogue or unexpected issuance
Because the logs capture all issuance, they let you spot certificates you did not authorize. If a certificate for your domain appears from a CA you never use, or names a subdomain you did not create, that is a red flag worth investigating: a compromised DNS record, a mis-issuance, or an attacker who passed domain validation. Monitoring CT for your domains, and enforcing CAA records to restrict which CAs may issue, turns the transparency logs into an early-warning system.
Reading the results
Each entry shows the covered names, the issuer, and the validity window. Group by name to see which subdomains have current versus expired certificates. Watch for issuers you do not recognize and for wildcard certificates you did not request. Note that CT also logs pre-certificates and renewals, so you will see many entries for an actively renewed name, like the frequent renewals of a Let's Encrypt certificate, which is normal rather than suspicious.
Frequently asked questions
- What is Certificate Transparency?
- Certificate Transparency (RFC 6962) is a framework of public, append-only logs that record every publicly trusted certificate a CA issues. Browsers like Chrome require proof of logging (an SCT) before trusting a certificate, so CAs log everything. This makes issuance auditable by anyone and lets you discover all certificates that exist for your domain.
- Can I find all subdomains of a domain this way?
- You can find every subdomain that has ever had a publicly trusted certificate, which is often most of them. Each certificate lists its SAN hostnames, so CT search reveals staging, admin, VPN, and other subdomains you may have forgotten. It will not show subdomains that never got a certificate, but it is one of the most effective passive discovery methods available.
- How can CT logs reveal a security problem?
- If a certificate appears for your domain from a CA you do not use, or covers a hostname you never created, it may signal mis-issuance, a DNS compromise, or an attacker who passed domain validation. Because all issuance is logged, you can catch such certificates early. Pair CT monitoring with CAA records that restrict which CAs may issue for your domain.
- Does every certificate appear in CT logs?
- Every publicly trusted certificate must be logged to be accepted by modern browsers, so effectively yes for anything used on the public web. Certificates from private or internal CAs that are not publicly trusted do not need to be logged and will not appear. For public TLS, CT is a near-complete record.
- Why do I see so many certificates for one name?
- Frequent, short-lived certificates produce many log entries. A domain using Let's Encrypt, for example, renews every 90 days (and some setups far more often), and each issuance plus its pre-certificate is logged. So a long list of entries for one hostname usually reflects healthy automated renewal, not a problem. Look at issuers and covered names for anything unexpected instead.
- Is searching CT logs legal and safe?
- Yes. CT logs are public by design and intended to be searched; monitors like crt.sh exist precisely so anyone can audit issuance. You are only reading a public record of certificates, not touching anyone's systems. It is a passive, non-intrusive check, which is exactly why it is so useful for asset discovery and monitoring your own domains.