Certificate Transparency Log Lookup
Look up every TLS certificate ever issued for a domain in the public Certificate Transparency logs (crt.sh) — discover subdomains, issuers, validity windows and wildcard certs.
Input
Enter a registered domain. Certificates and subdomains are discovered from the public Certificate Transparency logs (crt.sh).
Output
| Metric | Value |
|---|---|
| No data yet | |
| Issuer | Common name | Valid from | Valid to | Flags |
|---|---|---|---|---|
| No data yet | ||||
Guides
What this tool does
Enter a domain and this tool queries the public Certificate Transparency (CT) logs via crt.sh to list every TLS certificate ever issued for it. Because CT logs record all publicly-trusted certificates, they're a goldmine for discovering subdomains, auditing your certificate issuance, and spotting certificates you didn't expect.
How to use it
- Enter a registered domain, e.g.
example.com. - Optionally toggle Include subdomains (wildcard search), Unexpired only, or Wildcard only.
- Click Generate. Results come from crt.sh server-side and are deduped and sorted newest-first.
What you get back
- A summary — how many certificates and unique names were found.
- A certificate table — issuer, common name, validity window, and Expired/Wildcard flags.
- A list of unique names (subdomains and hostnames) seen across all certificates — useful for reconnaissance and asset inventory.
What is Certificate Transparency?
Certificate Transparency is an open framework (RFC 6962) requiring Certificate Authorities to publish every certificate they issue to append-only public logs. Browsers increasingly require CT proof before trusting a certificate. This transparency lets domain owners detect mis-issued or rogue certificates for their domains.
Notes
Results depend on crt.sh, which can be slow or rate-limited for busy domains. Large result sets are capped for readability. The domain you enter is used only to run the lookup and isn't stored.
Use it from code
From 3 credits per callREST API
curl -X POST https://api.iotools.cloud/v1/tool/certificate-transparency-log-lookup \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"domain": "github.com",
"includeSubdomains": "true"
}'Swap in your own key from your account. The tool's fields are the body — no wrapper.
Ask an AI agent
Use the IOTools `certificate-transparency-log-lookup` tool (Certificate Transparency Log Lookup) on this input:
YOUR_INPUT_HEREPaste this at any agent connected to the IOTools MCP server, then add your input.