Certificate Transparency search

What it shows

• Every unexpired certificate logged for the domain (and, unless you turn it off, its subdomains), newest first, with the names it covers, the issuer, its validity and whether it has been revoked.
• Every host name those certificates reveal. Certificate Transparency is public, so this is also what anyone can learn about your internal and staging names.
• Each certificate authority checked against your CAA records. A CA that issued a certificate your CAA records don't allow means either the records changed (and renewals from that CA will fail) or someone you don't know got a certificate.
• Names whose newest certificate expires within two weeks with no replacement logged, which usually means renewal has stopped working, plus wildcards and revoked certificates.

Data comes from SSLMate's Cert Spotter API, with crt.sh as a fallback, and is cached for 30 minutes. Very large domains are cut to the oldest few hundred certificates.

What Certificate Transparency is

Browsers only trust a certificate if it has been recorded in public, append-only Certificate Transparency logs. That makes every publicly trusted certificate visible, so a domain owner can spot one issued without their knowledge.

Logs record precertificates as well as certificates, so a name can appear here even if the certificate was never installed. Private CAs and internal certificates are not logged.

Questions

Why do I see certificates I didn't request?

Usually your CDN, hosting platform or email provider requested them for you, often from several CAs at once for redundancy. If none of them did, the domain may be compromised, or someone passed a CA's validation: revoke the certificate through the CA and find out how.

How do I stop other CAs issuing for my domain?

Publish CAA records listing only the CAs you use, for example example.com. CAA 0 issue "letsencrypt.org". CAs must check them before issuing. Remember to include the CAs your CDN uses.

Why are expired certificates missing?

The search lists only certificates that are still valid, which are the ones that matter for security and renewals. crt.sh keeps the full history if you need older ones.

Can I hide internal host names from CT logs?

Not for publicly trusted certificates. Use a wildcard certificate so individual names aren't logged, or a private CA for names that never face the internet.