Certificate Transparency · crt.sh
CT log search
See the certificates that CAs have logged for a domain and its subdomains: who issued them, when, and for which names. Results come from crt.sh, a public CT log search service, and can take a while for busy domains.
Search the logs
What Certificate Transparency shows
Publicly trusted CAs publish every certificate in public, append-only CT logs, or browsers will not accept it. Searching the logs shows what has been issued for your names: renewals, forgotten subdomains, certificates from CAs you don’t use, or ones nobody on your team requested.
- Each certificate is usually logged twice, as a precertificate and as the final certificate. They are merged into one row, and both crt.sh entries are linked.
- The names shown are the ones that matched your search; open the crt.sh entry to see the full certificate.
- Filter by issuer, hide expired or wildcard certificates, or show only the domain itself or only subdomains.
Your browser sends only the domain name to crt.sh. Large domains can take a minute or time out; the page retries once by itself.
Frequently asked questions
Why does crt.sh list a certificate twice?
CAs log a precertificate before issuing and usually the final certificate afterwards. Both share a serial number, so this page shows them as one certificate with two log entries.
I found a certificate I didn’t request. What now?
Note which CA issued it and use that CA’s problem-reporting address to ask for revocation. Then restrict future issuance with CAA records.
Why is my newest certificate missing?
Logs and crt.sh need time to take in new entries, usually minutes and sometimes hours. Try again later.