Find subdomains in public certificate logs.
Example
Overview
Names in certificate logs
| Name | Status | First seen | Valid until | Certificates | Issuer |
|---|
Findings
Capabilities and processing
Enter a domain or paste crt.sh JSON (add ?output=json to a search). For a domain, our server searches the public Certificate Transparency logs through a public log search service; pasted JSON is read in your browser.
Every name on a logged certificate is listed with when it was first seen, its latest expiry, how many certificates name it and who issued them. Names that usually point at internal services are flagged, and the list can be filtered and copied. Text that is not JSON can still be read for names.
Example workflow
The sample domain has 19 logged certificates, including names for staging, Jenkins and a VPN.
Limits and interpretation
Only names returned by the public log search appear. Upstream availability varies; failures are reported without substituting sample results. Responses are limited to 2 MiB and 20,000 certificate rows. A wildcard hides the names under it, and a name stays in the logs after its server is gone. Nothing is stored.