Certificate Transparency Monitor
Search crt.sh for Certificate Transparency entries matching a domain. Review issuers and certificate dates to investigate unexpected issuance. This is an on-demand lookup, not an alerting service.
What Is Certificate Transparency?
Certificate Transparency (CT) makes certificate issuance publicly auditable through append-only logs. Browsers such as Chrome require qualifying publicly trusted TLS certificates to comply with their CT policies. Searching log entries can help identify unexpected certificates, but a lookup cannot prove that no unauthorized certificate exists.
Why Monitor CT Logs?
- Investigate unexpected issuers, names, or validity dates for your domain.
- Review logged certificates when planning renewals.
- Collect evidence for a certificate inventory or security review.
- Use a separate monitoring service if you need continuous checks and alerts.
Data sourced from crt.sh, a public CT log search engine operated by Sectigo.
How This Tool Works
Enter a domain name and we query crt.sh for matching CT entries. The table shows up to 100 entries, sorted by log entry time, with issuer, validity dates, and links to certificate details. Summary counts describe the matches returned by crt.sh; they are not a verified count of every certificate ever issued.
Related Tools & Guides
- Forward DNS Lookup - check A, AAAA, MX, TXT, and NS records for your domain.
- Domain Security Scanner - verify HSTS and other security headers for your domain.
- IP Lookup - view geolocation and network details for any server IP.
- Email Security Checker - audit MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, and BIMI for the same domain.
- Complete Guide to Online Anonymity - protect your identity when browsing the web.
Frequently Asked Questions
Can anyone search CT logs?
Yes. Certificate Transparency logs are public by design. Search services such as crt.sh make logged entries available to researchers and domain owners. Coverage and availability depend on the service.
What is a wildcard certificate?
A wildcard name such as *.example.com matches one leftmost label, such as www.example.com. It does not by itself cover example.com or a.b.example.com. The certificate needs separate names for that coverage. This tool flags wildcard names among the returned matches.
How do I detect unauthorized certificates?
Search for your domain in this tool and review the list of issuers. If you see a CA that you did not authorize or certificates you did not request, investigate immediately and consider revoking them.