Certificate Transparency Lookup

What it does

Type a domain and get back the certificates that have been published for it in the public Certificate Transparency logs: common name, issuer, the validity window with days remaining or days since expiry, the subject alternative names on each one, and a link to the log entry where available. Expired certificates are included by default, because the interesting question is usually historical.

The second view is the one most people come for. It takes every name from every certificate in the result — common names and SANs alike — folds them into a deduplicated list sorted by domain suffix so siblings group together, and gives you a single button to copy the lot. Wildcards are kept and labelled rather than silently expanded. There is a CSV export for the certificate table when you need the issuance dates in a spreadsheet.

How it works

The query runs at /api/ct-lookup, an edge function that forwards the domain to CertIndex and applies a limit of thirty lookups an hour. The tool never talks to a log directly; it reads an index built over them, which is the difference between a search that returns in a second and one that would require downloading a log’s entire Merkle tree.

The underlying data comes from the ecosystem defined in RFC 6962. A certificate authority submits each certificate to append-only logs before issuing it, and receives signed certificate timestamps that get embedded in the certificate itself. Chrome will not trust a publicly issued certificate that lacks them. The consequence is that essentially every certificate from a public CA since 2018 is in the logs, and because the logs are append-only, nothing is ever removed. A hostname that appeared in a certificate in 2019 is still there.

That property is what makes the tool useful and also what limits it. The logs record issuance, not reality.

What the logs cannot tell you

Three gaps are worth holding in your head before you act on a result.

A name in the list may not resolve. Certificates outlive the hosts they were issued for, and a staging environment torn down two years ago leaves a permanent record. Resolve each name before treating it as live — the DNS lookup tool next door is the quickest way to do that in bulk.

A host may exist and be entirely absent. Wildcards are the main reason: a certificate for *.example.com covers every subdomain without naming any of them, so an organisation that standardised on wildcards has almost nothing to enumerate. Private certificate authorities are the other reason. An internal PKI or a service mesh issuing its own certificates never touches the public logs, which is exactly why those things exist.

Duplicate-looking entries are usually not duplicates. Automated renewal produces a fresh certificate every month or two, and most CAs log a pre-certificate alongside the final one, so a single name under ACME can accumulate dozens of entries a year. Sort by issuance date and read the pattern rather than the count.

When to reach for it

The defensive use is the one to make routine. Search your own domains on a schedule and read the issuer column: a certificate for your name from a CA you do not use is either shadow IT or something worse, and CT is the only place it will show up without your involvement. Adding a CAA record — see RFC 8659 — turns that detection into prevention for the next attempt.

It is also the fastest inventory you can build during an incident or a migration. Before you decommission a load balancer, the hostname list tells you which names were ever pointed at it. Before an audit, the certificate table tells you which issuers you actually depend on, which is frequently not the list in the runbook.

Related tools

• TLS certificate inspector for the certificate a host is serving right now, rather than the ones it was issued.
• DNS lookup to check which of these names still resolve, and which CAs your CAA records permit.
• HTTP header inspector for what the surviving hosts return.
• Nginx and Caddy config generator when a discovered host turns out to need a proper server block.
• Hash generator for comparing a fingerprint from this table against a certificate you hold.