CT Log Search
Every certificate any CA has issued for a domain, from the public Certificate Transparency logs.
What this tool does
Searches the public Certificate Transparency logs for every certificate ever issued for a domain. Since 2018 every publicly trusted CA has been required to publish each certificate it signs to these append-only logs, which makes them the authoritative record of what exists — including certificates nobody at your organisation ordered.
Unlike the other tools here, this one leaves your machine: the domain is sent to api.certspotter.com, which indexes the logs. See the privacy policy.
How to use it
Enter a domain and press Search. Leave "Include subdomains" on to see certificates issued for any name beneath it, which is usually what you want when auditing.
Reading the result
The summary shows how many certificates exist, how many are currently valid, how many were issued in the last seven days, and which CAs issued them. The table lists each certificate with its dates, names, issuer and status; anything issued in the last week is highlighted.
Common problems
- A certificate you do not recognise. Worth chasing down — some CA issued for your name. Publish a CAA record to prevent a repeat.
- Duplicates on the same day. Normal. Certificates are logged more than once, and ACME clients often issue several during setup.
- Nothing logged for a live HTTPS site. Either the certificate is internal or self-signed, or it predates mandatory logging.
- Rate-limited. The upstream API limits unauthenticated queries per IP. Wait a few minutes.