What are Certificate Transparency logs?
Since 2018 public CAs must record every TLS certificate in several public, append-only logs, otherwise Chrome and Safari reject it. This makes it possible to see which certificates exist for a domain, including ones you do not know about.
What the search is good for
- Finding forgotten subdomains: test systems, old campaign sites or services run by contractors show up in certificates even if they are in no inventory.
- Spotting unknown issuers: if a CA appears that you do not work with, a contractor or another department may have ordered a certificate. In the worst case it is a mis-issuance.
- Keeping an eye on expiry: certificates that expire soon and have no successor yet are highlighted.
- Comparing with CAA: the tool reads your CAA record and flags active certificates from CAs that are not allowed there.
Good to know
The logs only contain publicly trusted certificates. Internal CAs and self-signed certificates do not appear. Precertificate and final certificate are merged into one entry. Because the logs are public, do not put confidential names into public certificates. A wildcard certificate does not reveal individual hosts.
Next steps: the CAA generator to define which CAs may issue, and the SSL check to see what a server actually sends.
FAQ
Why do I see subdomains that no longer exist?
The CT logs are an archive. Names switched off long ago stay visible. By default the search only shows valid certificates; tick “include expired” for the history.
A certificate comes from a CA I do not know. What should I do?
First check whether a provider (CDN, mail service, hosting) requested it. If not, report it to the CA for revocation and use a CAA record to define which CAs may issue in future.
Why does the search sometimes take long?
The data comes from crt.sh, a free database that processes all logs. For large domains with tens of thousands of certificates the answer can take a while or not arrive. Results are therefore cached for an hour.
Do internal certificates show up?
No. Certificates from your own internal CA are not recorded in CT logs.
Can I process the results further?
Yes. Names and certificates can be downloaded as CSV, for example for an inventory or a comparison with your DNS zone.