Certificate transparency search

See every publicly logged certificate for a domain, who issued each one, when, and which names it covers.

Try:

Results for example.org

Checked 2026-11-15stored copy0 ms

Showing a stored copy because the source isn't answering right now. Check again in a minute for a fresh one.

Showing a copy from 63 minutes ago because the logs aren’t answering. As of 15 Nov 2026.

Logged certificates

32 certificates logged for example.org

The newest was issued 2026-09-26 by Cloudflare (SSL Corp) and runs to 2026-12-25. Certificates here are renewed about every 8 days.

Includes subdomains5 valid nowAs of 15 Nov 2026crt.sh

Newest valid

Cloudflare TLS Issuing ECC CA 3

Certificates by issuer

Cloudflare (SSL Corp)10 of 32
DigiCert10 of 32
Sectigo5 of 32
Cloudflare4 of 32
T-Systems SfR2 of 32
Other (1)1 of 32

32 certificates from 6 issuers between 2011 and 2026. Filled bars are valid now, outlined bars have expired. The newest runs until 25 Dec 2026. Cloudflare (SSL Corp) issued the most.

Logged

58 log entries, merged

Valid now

The newest to 2026-12-25

Renewal cadence

8days

Median gap between issues

Issuer mix

16 certificates are wildcards. A wildcard covers every name one level below it, so it does not list them. The subdomain finder lists the names that appear in certificates.

Certificates32

Newest first. Without JavaScript every certificate on this page is listed.

example.org +1 nameCloudflare TLS Issuing ECC CA 3 · 2026-09-26 to 2026-12-25WildcardValid
*.example.org example.org
Serial
0ffbc4fba7b8b237ecfda4bf0719133f
Issuer
SSL Corporation, Cloudflare TLS Issuing ECC CA 3, US
Valid for
90 days, 40 days left
Log entries
1
Open on crt.sh Check the live certificate
example.org +1 nameCloudflare TLS Issuing ECC CA 3 · 2026-09-26 to 2026-12-25WildcardValid
*.example.org example.org
Serial
09c678017c601c05ade15d0a776cb5b3
Issuer
SSL Corporation, Cloudflare TLS Issuing ECC CA 3, US
Valid for
90 days, 40 days left
Log entries
1
Open on crt.sh Check the live certificate
example.org +1 nameCloudflare TLS Issuing ECC CA 3 · 2026-07-29 to 2026-10-27WildcardPrecertificate and finalExpired
*.example.org example.org
Serial
009c81d444f55c6aa13536dfc5642da4
Issuer
SSL Corporation, Cloudflare TLS Issuing ECC CA 3, US
Valid for
90 days
Log entries
2 (precertificate and final, merged)
Open on crt.sh
example.org +1 nameCloudflare TLS Issuing RSA CA 3 · 2026-07-29 to 2026-10-27WildcardPrecertificate and finalExpired
*.example.org example.org
Serial
6d1c362ded0f4290b2ee803f827e17b2
Issuer
SSL Corporation, Cloudflare TLS Issuing RSA CA 3, US
Valid for
90 days
Log entries
2 (precertificate and final, merged)
Open on crt.sh
example.org +1 nameCloudflare TLS Issuing ECC CA 3 · 2026-05-31 to 2026-08-29WildcardPrecertificate and finalExpired
*.example.org example.org
Serial
38c432085bfb48407103ca82741411af
Issuer
SSL Corporation, Cloudflare TLS Issuing ECC CA 3, US
Valid for
90 days
Log entries
2 (precertificate and final, merged)
Open on crt.sh
example.org +1 nameCloudflare TLS Issuing RSA CA 3 · 2026-05-31 to 2026-08-29WildcardPrecertificate and finalExpired
*.example.org example.org
Serial
0540eb70014596a4e1fd3e05e77a92f7
Issuer
SSL Corporation, Cloudflare TLS Issuing RSA CA 3, US
Valid for
90 days
Log entries
2 (precertificate and final, merged)
Open on crt.sh
example.org +1 nameCloudflare TLS Issuing ECC CA 1 · 2026-04-02 to 2026-07-01WildcardPrecertificate and finalExpired
*.example.org example.org
Serial
4def09a6c789cb70b7944221c45abeb9
Issuer
CLOUDFLARE, INC., Cloudflare TLS Issuing ECC CA 1, US
Valid for
89 days
Log entries
2 (precertificate and final, merged)
Open on crt.sh
example.org +1 nameCloudflare TLS Issuing RSA CA 1 · 2026-04-02 to 2026-07-01WildcardPrecertificate and finalExpired
*.example.org example.org
Serial
451811c71b1568ea2dfa36f24972a419
Issuer
CLOUDFLARE, INC., Cloudflare TLS Issuing RSA CA 1, US
Valid for
89 days
Log entries
2 (precertificate and final, merged)
Open on crt.sh
example.org +1 nameCloudflare TLS Issuing ECC CA 1 · 2026-04-02 to 2026-07-01WildcardExpired
*.example.org example.org
Serial
7562014b98a757f2b507fed32116a0d0
Issuer
CLOUDFLARE, INC., Cloudflare TLS Issuing ECC CA 1, US
Valid for
89 days
Log entries
1
Open on crt.sh
example.org +1 nameCloudflare TLS Issuing RSA CA 1 · 2026-04-02 to 2026-07-01WildcardExpired
*.example.org example.org
Serial
51bafaa692c9cfbf1019e1dbc846b32f
Issuer
CLOUDFLARE, INC., Cloudflare TLS Issuing RSA CA 1, US
Valid for
90 days
Log entries
1
Open on crt.sh
example.org +1 nameCloudflare TLS Issuing ECC CA 3 · 2026-02-07 to 2026-05-08WildcardPrecertificate and finalExpired
*.example.org example.org
Serial
57775679ee37024d73d22c13d7508fd0
Issuer
SSL Corporation, Cloudflare TLS Issuing ECC CA 3, US
Valid for
90 days
Log entries
2 (precertificate and final, merged)
Open on crt.sh
example.org +1 nameCloudflare TLS Issuing RSA CA 3 · 2026-02-07 to 2026-05-08WildcardPrecertificate and finalExpired
*.example.org example.org
Serial
5397f17937d6162acf5714b797070919
Issuer
SSL Corporation, Cloudflare TLS Issuing RSA CA 3, US
Valid for
90 days
Log entries
2 (precertificate and final, merged)
Open on crt.sh
example.org +1 nameCloudflare TLS Issuing ECC CA 3 · 2025-12-10 to 2026-03-10WildcardPrecertificate and finalExpired
*.example.org example.org
Serial
1180684e41a970bae84c2e6db581fdcf
Issuer
SSL Corporation, Cloudflare TLS Issuing ECC CA 3, US
Valid for
90 days
Log entries
2 (precertificate and final, merged)
Open on crt.sh
example.org +1 nameCloudflare TLS Issuing RSA CA 3 · 2025-12-10 to 2026-03-10WildcardPrecertificate and finalExpired
*.example.org example.org
Serial
268784e64379145cedd9579722f4dc54
Issuer
SSL Corporation, Cloudflare TLS Issuing RSA CA 3, US
Valid for
90 days
Log entries
2 (precertificate and final, merged)
Open on crt.sh
example.org +2 namesSectigo Public Server Authentication CA OV R36 · 2025-12-02 to 2026-12-02Precertificate and finalValid
example.com example.org www.example.org
Serial
531e16f0f28235b65cc7cd35a5f0710b
Issuer
Sectigo Limited, Sectigo Public Server Authentication CA OV R36, GB
Valid for
365 days, 17 days left
Log entries
2 (precertificate and final, merged)
Open on crt.sh Check the live certificate
example.org +2 namesSectigo Public Server Authentication CA OV R36 · 2025-11-21 to 2026-11-21Precertificate and finalValid
example.com example.org www.example.org
Serial
0f8f7abde735d78baa0bd4053f39021c
Issuer
Sectigo Limited, Sectigo Public Server Authentication CA OV R36, GB
Valid for
365 days, 6 days left
Log entries
2 (precertificate and final, merged)
Open on crt.sh Check the live certificate
example.org +1 nameSectigo Public Server Authentication CA OV R36 · 2025-11-20 to 2026-11-20Precertificate and finalValid
example.com example.org
Serial
009de10580fa26441939f38af4afb1cb40
Issuer
Sectigo Limited, Sectigo Public Server Authentication CA OV R36, GB
Valid for
365 days, 5 days left
Log entries
2 (precertificate and final, merged)
Open on crt.sh Check the live certificate
example.org +1 nameSectigo ECC Organization Validation Secure Server CA · 2025-02-07 to 2026-03-10WildcardPrecertificate and finalExpired
*.example.org example.org
Serial
00e4e1a95d35d7f77936e2fea2e3547a4c
Issuer
Sectigo Limited, Sectigo ECC Organization Validation Secure Server CA, GB
Valid for
396 days
Log entries
2 (precertificate and final, merged)
Open on crt.sh
example.org +1 nameSectigo RSA Domain Validation Secure Server CA · 2025-01-27 to 2025-04-28Precertificate and finalExpired
example.org www.example.org
Serial
0b14ee0318178df301c33a53ceff6e5d
Issuer
Sectigo Limited, Sectigo RSA Domain Validation Secure Server CA, GB
Valid for
91 days
Log entries
2 (precertificate and final, merged)
Open on crt.sh
example.org +1 nameDigiCert Global G3 TLS ECC SHA384 2020 CA1 · 2025-01-15 to 2026-01-15WildcardPrecertificate and finalExpired
*.example.org example.org
Serial
0722a749b558476196d554445edbd254
Issuer
DigiCert Inc, DigiCert Global G3 TLS ECC SHA384 2020 CA1, US
Valid for
365 days
Log entries
2 (precertificate and final, merged)
Open on crt.sh
example.org +1 nameDigiCert Global G2 TLS RSA SHA256 2020 CA1 · 2025-01-14 to 2026-02-14Precertificate and finalExpired
example.org www.example.org
Serial
0202d62a240d61737b5dbf132c87fcf3
Issuer
DigiCert Inc, DigiCert Global G2 TLS RSA SHA256 2020 CA1, US
Valid for
396 days
Log entries
2 (precertificate and final, merged)
Open on crt.sh
example.org +1 nameDigiCert Global G2 TLS RSA SHA256 2020 CA1 · 2024-01-30 to 2025-03-01Precertificate and finalExpired
example.org www.example.org
Serial
075bcef30689c8addf13e51af4afe187
Issuer
DigiCert Inc, DigiCert Global G2 TLS RSA SHA256 2020 CA1, US
Valid for
396 days
Log entries
2 (precertificate and final, merged)
Open on crt.sh
example.org +1 nameDigiCert TLS RSA SHA256 2020 CA1 · 2023-01-13 to 2024-02-13Precertificate and finalExpired
example.org www.example.org
Serial
0c1fcb184518c7e3866741236d6b73f1
Issuer
DigiCert Inc, DigiCert TLS RSA SHA256 2020 CA1, US
Valid for
396 days
Log entries
2 (precertificate and final, merged)
Open on crt.sh
example.org +1 nameDigiCert TLS RSA SHA256 2020 CA1 · 2022-03-14 to 2023-03-14Precertificate and finalExpired
example.org www.example.org
Serial
0faa63109307bc3d414892640ccd4d9a
Issuer
DigiCert Inc, DigiCert TLS RSA SHA256 2020 CA1, US
Valid for
365 days
Log entries
2 (precertificate and final, merged)
Open on crt.sh
example.org +1 nameDigiCert TLS RSA SHA256 2020 CA1 · 2021-12-10 to 2022-12-09Precertificate and finalExpired
example.org www.example.org
Serial
025216e1c4998e2632aa5d1da985b43c
Issuer
DigiCert Inc, DigiCert TLS RSA SHA256 2020 CA1, US
Valid for
364 days
Log entries
2 (precertificate and final, merged)
Open on crt.sh
example.org +1 nameDigiCert TLS RSA SHA256 2020 CA1 · 2020-11-24 to 2021-12-25Precertificate and finalExpired
example.org www.example.org
Serial
0fbe08b0854d05738ab0cce1c9afeec9
Issuer
DigiCert Inc, DigiCert TLS RSA SHA256 2020 CA1, US
Valid for
396 days
Log entries
2 (precertificate and final, merged)
Open on crt.sh
example.org +1 nameDigiCert SHA2 Secure Server CA · 2018-11-28 to 2020-12-02Precertificate and finalExpired
example.org www.example.org
Serial
0fd078dd48f1a2bd4d0f2ba96b6038fe
Issuer
DigiCert Inc, DigiCert SHA2 Secure Server CA, US
Valid for
735 days
Log entries
5 (precertificate and final, merged)
Open on crt.sh
example.org +1 nameDigiCert SHA2 High Assurance Server CA · 2015-11-03 to 2018-11-28Expired
example.org www.example.org
Serial
0e64c5fbc236ade14b172aeb41c78cb0
Issuer
DigiCert Inc, DigiCert SHA2 High Assurance Server CA, US
Valid for
1,121 days
Log entries
1
Open on crt.sh
example.org +1 nameDigiCert SHA2 High Assurance Server CA · 2014-11-06 to 2015-11-13Expired
example.org www.example.org
Serial
0411de8f53b462f6a5a861b712ec6b59
Issuer
DigiCert Inc, DigiCert SHA2 High Assurance Server CA, US
Valid for
372 days
Log entries
1
Open on crt.sh
tdreg001.t-systems-sfr.com +1 nameT-Systems SfR CA 2 · 2014-04-10 to 2019-04-09Email certificateExpired
[email protected] tdreg001.t-systems-sfr.com
Serial
1765bed9246411
Issuer
T-Systems SfR GmbH, T-Systems SfR CA 2, DE
Valid for
1,825 days
Log entries
1
Open on crt.sh
tdhost001.t-systems-sfr.com +1 nameT-Systems SfR CA 2 · 2014-04-10 to 2019-04-09Email certificateExpired
[email protected] tdhost001.t-systems-sfr.com
Serial
1765bed8b82141
Issuer
T-Systems SfR GmbH, T-Systems SfR CA 2, DE
Valid for
1,825 days
Log entries
1
Open on crt.sh
www.testdomain.example.org +1 nameHU-CA · 2011-01-11 to 2016-01-10Expired
www.testdomain.example.org www2.hu-berlin.de
Serial
114b83a1
Issuer
Humboldt-Universitaet zu Berlin, HU-CA, DE
Valid for
1,825 days
Log entries
1
Open on crt.sh

Where this came from

1 of 2 sources answered

Cert SpotterNot asked
crt.shStored copyStored copy, 63 minutes old

crt.sh is free but often down. Cert Spotter is fast. We ask both and merge what they return. Credit: crt.sh by Sectigo and Cert Spotter by SSLMate. Revocation is only known for certificates Cert Spotter returned.

As of 15 Nov 2026. Results are kept for an hour so repeat searches are quick.

See the subdomains in these certificates: Subdomain finder.

Structured result (JSON) · 18 KB

{
  "domain": "example.org",
  "includeSubdomains": true,
  "excludeExpired": false,
  "sources": [
    {
      "id": "certspotter",
      "name": "Cert Spotter",
      "status": "skipped"
    },
    {
      "id": "crtsh",
      "name": "crt.sh",
      "status": "stored",
      "ms": 5454,
      "ageSeconds": 3782
    }
  ],
  "asOf": "2026-11-15T16:20:00.347Z",
  "stale": true,
  "summary": {
    "certificates": 32,
    "rawEntries": 58,
    "firstLogged": "2011-01-11",
    "lastLogged": "2026-09-26",
    "currentlyValid": 5,
    "wildcards": 16,
    "issuers": [
      {
        "name": "SSL Corporation",
        "short": "Cloudflare (SSL Corp)",
        "count": 10
      },
      {
        "name": "DigiCert Inc",
        "short": "DigiCert",
        "count": 10
      },
      {
        "name": "Sectigo Limited",
        "short": "Sectigo",
        "count": 5
      },
      {
        "name": "CLOUDFLARE, INC.",
        "short": "Cloudflare",
        "count": 4
      },
      {
        "name": "T-Systems SfR GmbH",
        "short": "T-Systems SfR",
        "count": 2
      },
      {
        "name": "Humboldt-Universitaet zu Berlin",
        "short": "Humboldt-Universitaet z…",
        "count": 1
      }
    ],
    "cadenceDays": 8,
    "truncated": false,
    "newestEnd": "2026-12-25"
  },
  "certificates": [
    {
      "serial": "0ffbc4fba7b8b237ecfda4bf0719133f",
      "issuer": {
        "country": "US",
        "org": "SSL Corporation",
        "cn": "Cloudflare TLS Issuing ECC CA 3"
      },
      "notBefore": "2026-09-26",
      "notAfter": "2026-12-25",
      "validDays": 90,
      "state": "valid",
      "daysLeft": 40,
      "names": [
        "*.example.org",
        "example.org"
      ],
      "kind": "unknown",
      "revoked": false,
      "logEntries": 1,
      "crtshId": 29653203136,
      "lane": 0
    },
    {
      "serial": "09c678017c601c05ade15d0a776cb5b3",
      "issuer": {
        "country": "US",
        "org": "SSL Corporation",
        "cn": "Cloudflare TLS Issuing ECC CA 3"
      },
      "notBefore": "2026-09-26",
      "notAfter": "2026-12-25",
      "validDays": 90,
      "state": "valid",
      "daysLeft": 40,
      "names": [
        "*.example.org",
        "example.org"
      ],
      "kind": "unknown",
      "revoked": false,
      "logEntries": 1,
      "crtshId": 29597863421,
      "lane": 0
    },
    {
      "serial": "009c81d444f55c6aa13536dfc5642da4",
      "issuer": {
        "country": "US",
        "org": "SSL Corporation",
        "cn": "Cloudflare TLS Issuing ECC CA 3"
      },
      "notBefore": "2026-07-29",
      "notAfter": "2026-10-27",
      "validDays": 90,
      "state": "expired",
      "names": [
        "*.example.org",
        "example.org"
      ],
      "kind": "final-and-precert",
      "revoked": false,
      "logEntries": 2,
      "crtshId": 28361105002,
      "lane": 0
    },
    {
      "serial": "6d1c362ded0f4290b2ee803f827e17b2",
      "issuer": {
        "country": "US",
        "org": "SSL Corporation",
        "cn": "Cloudflare TLS Issuing RSA CA 3"
      },
      "notBefore": "2026-07-29",
      "notAfter": "2026-10-27",
      "validDays": 90,
      "state": "expired",
      "names": [
        "*.example.org",
        "example.org"
      ],
      "kind": "final-and-precert",
      "revoked": false,
      "logEntries": 2,
      "crtshId": 28361106104,
      "lane": 0
    },
    {
      "serial": "38c432085bfb48407103ca82741411af",
      "issuer": {
        "country": "US",
        "org": "SSL Corporation",
        "cn": "Cloudflare TLS Issuing ECC CA 3"
      },
      "notBefore": "2026-05-31",
      "notAfter": "2026-08-29",
      "validDays": 90,
      "state": "expired",
      "names": [
        "*.example.org",
        "example.org"
      ],
      "kind": "final-and-precert",
      "revoked": false,
      "logEntries": 2,
      "crtshId": 26786537377,
      "lane": 0
    },
    {
      "serial": "0540eb70014596a4e1fd3e05e77a92f7",
      "issuer": {
        "country": "US",
        "org": "SSL Corporation",
        "cn": "Cloudflare TLS Issuing RSA CA 3"
      },
      "notBefore": "2026-05-31",
      "notAfter": "2026-08-29",
      "validDays": 90,
      "state": "expired",
      "names": [
        "*.example.org",
        "example.org"
      ],
      "kind": "final-and-precert",
      "revoked": false,
      "logEntries": 2,
      "crtshId": 26786768481,
      "lane": 0
    },
    {
      "serial": "4def09a6c789cb70b7944221c45abeb9",
      "issuer": {
        "country": "US",
        "org": "CLOUDFLARE, INC.",
        "cn": "Cloudflare TLS Issuing ECC CA 1"
      },
      "notBefore": "2026-04-02",
      "notAfter": "2026-07-01",
      "validDays": 89,
      "state": "expired",
      "names": [
        "*.example.org",
        "example.org"
      ],
      "kind": "final-and-precert",
      "revoked": false,
      "logEntries": 2,
      "crtshId": 25375849853,
      "lane": 3
    },
    {
      "serial": "451811c71b1568ea2dfa36f24972a419",
      "issuer": {
        "country": "US",
        "org": "CLOUDFLARE, INC.",
        "cn": "Cloudflare TLS Issuing RSA CA 1"
      },
      "notBefore": "2026-04-02",
      "notAfter": "2026-07-01",
      "validDays": 89,
      "state": "expired",
      "names": [
        "*.example.org",
        "example.org"
      ],
      "kind": "final-and-precert",
      "revoked": false,
      "logEntries": 2,
      "crtshId": 25405864250,
      "lane": 3
    },
    {
      "serial": "7562014b98a757f2b507fed32116a0d0",
      "issuer": {
        "country": "US",
        "org": "CLOUDFLARE, INC.",
        "cn": "Cloudflare TLS Issuing ECC CA 1"
      },
      "notBefore": "2026-04-02",
      "notAfter": "2026-07-01",
      "validDays": 89,
      "state": "expired",
      "names": [
        "*.example.org",
        "example.org"
      ],
      "kind": "unknown",
      "revoked": false,
      "logEntries": 1,
      "crtshId": 25369347805,
      "lane": 3
    },
    {
      "serial": "51bafaa692c9cfbf1019e1dbc846b32f",
      "issuer": {
        "country": "US",
        "org": "CLOUDFLARE, INC.",
        "cn": "Cloudflare TLS Issuing RSA CA 1"
      },
      "notBefore": "2026-04-02",
      "notAfter": "2026-07-01",
      "validDays": 90,
      "state": "expired",
      "names": [
        "*.example.org",
        "example.org"
      ],
      "kind": "unknown",
      "revoked": false,
      "logEntries": 1,
      "crtshId": 25368675596,
      "lane": 3
    },
    {
      "serial": "57775679ee37024d73d22c13d7508fd0",
      "issuer": {
        "country": "US",
        "org": "SSL Corporation",
        "cn": "Cloudflare TLS Issuing ECC CA 3"
      },
      "notBefore": "2026-02-07",
      "notAfter": "2026-05-08",
      "validDays": 90,
      "state": "expired",
      "names": [
        "*.example.org",
        "example.org"
      ],
      "kind": "final-and-precert",
      "revoked": false,
      "logEntries": 2,
      "crtshId": 24249798966,
      "lane": 0
    },
    {
      "serial": "5397f17937d6162acf5714b797070919",
      "issuer": {
        "country": "US",
        "org": "SSL Corporation",
        "cn": "Cloudflare TLS Issuing RSA CA 3"
      },
      "notBefore": "2026-02-07",
      "notAfter": "2026-05-08",
      "validDays": 90,
      "state": "expired",
      "names": [
        "*.example.org",
        "example.org"
      ],
      "kind": "final-and-precert",
      "revoked": false,
      "logEntries": 2,
      "crtshId": 24249819311,
      "lane": 0
    },
    {
      "serial": "1180684e41a970bae84c2e6db581fdcf",
      "issuer": {
        "country": "US",
        "org": "SSL Corporation",
        "cn": "Cloudflare TLS Issuing ECC CA 3"
      },
      "notBefore": "2025-12-10",
      "notAfter": "2026-03-10",
      "validDays": 90,
      "state": "expired",
      "names": [
        "*.example.org",
        "example.org"
      ],
      "kind": "final-and-precert",
      "revoked": false,
      "logEntries": 2,
      "crtshId": 23040102095,
      "lane": 0
    },
    {
      "serial": "268784e64379145cedd9579722f4dc54",
      "issuer": {
        "country": "US",
        "org": "SSL Corporation",
        "cn": "Cloudflare TLS Issuing RSA CA 3"
      },
      "notBefore": "2025-12-10",
      "notAfter": "2026-03-10",
      "validDays": 90,
      "state": "expired",
      "names": [
        "*.example.org",
        "example.org"
      ],
      "kind": "final-and-precert",
      "revoked": false,
      "logEntries": 2,
      "crtshId": 23040093594,
      "lane": 0
    },
    {
      "serial": "531e16f0f28235b65cc7cd35a5f0710b",
      "issuer": {
        "country": "GB",
        "org": "Sectigo Limited",
        "cn": "Sectigo Public Server Authentication CA OV R36"
      },
      "notBefore": "2025-12-02",
      "notAfter": "2026-12-02",
      "validDays": 365,
      "state": "valid",
      "daysLeft": 17,
      "names": [
        "example.com",
        "example.org",
        "www.example.org"
      ],
      "kind": "final-and-precert",
      "revoked": false,
      "logEntries": 2,
      "crtshId": 22853418213,
      "lane": 2
    },
    {
      "serial": "0f8f7abde735d78baa0bd4053f39021c",
      "issuer": {
        "country": "GB",
        "org": "Sectigo Limited",
        "cn": "Sectigo Public Server Authentication CA OV R36"
      },
      "notBefore": "2025-11-21",
      "notAfter": "2026-11-21",
      "validDays": 365,
      "state": "valid",
      "daysLeft": 6,
      "names": [
        "example.com",
        "example.org",
        "www.example.org"
      ],
      "kind": "final-and-precert",
      "revoked": false,
      "logEntries": 2,
      "crtshId": 22648264889,
      "lane": 2
    },
    {
      "serial": "009de10580fa26441939f38af4afb1cb40",
      "issuer": {
        "country": "GB",
        "org": "Sectigo Limited",
        "cn": "Sectigo Public Server Authentication CA OV R36"
      },
      "notBefore": "2025-11-20",
      "notAfter": "2026-11-20",
      "validDays": 365,
      "state": "valid",
      "daysLeft": 5,
      "names": [
        "example.com",
        "example.org"
      ],
      "kind": "final-and-precert",
      "revoked": false,
      "logEntries": 2,
      "crtshId": 22625582522,
      "lane": 2
    },
    {
      "serial": "00e4e1a95d35d7f77936e2fea2e3547a4c",
      "issuer": {
        "country": "GB",
        "org": "Sectigo Limited",
        "cn": "Sectigo ECC Organization Validation Secure Server CA"
      },
      "notBefore": "2025-02-07",
      "notAfter": "2026-03-10",
      "validDays": 396,
      "state": "expired",
      "names": [
        "*.example.org",
        "example.org"
      ],
      "kind": "final-and-precert",
      "revoked": false,
      "logEntries": 2,
      "crtshId": 16593701385,
      "lane": 2
    },
    {
      "serial": "0b14ee0318178df301c33a53ceff6e5d",
      "issuer": {
        "country": "GB",
        "org": "Sectigo Limited",
        "cn": "Sectigo RSA Domain Validation Secure Server CA"
      },
      "notBefore": "2025-01-27",
      "notAfter": "2025-04-28",
      "validDays": 91,
      "state": "expired",
      "names": [
        "example.org",
        "www.example.org"
      ],
      "kind": "final-and-precert",
      "revoked": false,
      "logEntries": 2,
      "crtshId": 16488426834,
      "lane": 2
    },
    {
      "serial": "0722a749b558476196d554445edbd254",
      "issuer": {
        "country": "US",
        "org": "DigiCert Inc",
        "cn": "DigiCert Global G3 TLS ECC SHA384 2020 CA1"
      },
      "notBefore": "2025-01-15",
      "notAfter": "2026-01-15",
      "validDays": 365,
      "state": "expired",
      "names": [
        "*.example.org",
        "example.org"
      ],
      "kind": "final-and-precert",
      "revoked": false,
      "logEntries": 2,
      "crtshId": 19515382447,
      "lane": 1
    },
    {
      "serial": "0202d62a240d61737b5dbf132c87fcf3",
      "issuer": {
        "country": "US",
        "org": "DigiCert Inc",
        "cn": "DigiCert Global G2 TLS RSA SHA256 2020 CA1"
      },
      "notBefore": "2025-01-14",
      "notAfter": "2026-02-14",
      "validDays": 396,
      "state": "expired",
      "names": [
        "example.org",
        "www.example.org"
      ],
      "kind": "final-and-precert",
      "revoked": false,
      "logEntries": 2,
      "crtshId": 16233306772,
      "lane": 1
    },
    {
      "serial": "075bcef30689c8addf13e51af4afe187",
      "issuer": {
        "country": "US",
        "org": "DigiCert Inc",
        "cn": "DigiCert Global G2 TLS RSA SHA256 2020 CA1"
      },
      "notBefore": "2024-01-30",
      "notAfter": "2025-03-01",
      "validDays": 396,
      "state": "expired",
      "names": [
        "example.org",
        "www.example.org"
      ],
      "kind": "final-and-precert",
      "revoked": false,
      "logEntries": 2,
      "crtshId": 12337892544,
      "lane": 1
    },
    {
      "serial": "0c1fcb184518c7e3866741236d6b73f1",
      "issuer": {
        "country": "US",
        "org": "DigiCert Inc",
        "cn": "DigiCert TLS RSA SHA256 2020 CA1"
      },
      "notBefore": "2023-01-13",
      "notAfter": "2024-02-13",
      "validDays": 396,
      "state": "expired",
      "names": [
        "example.org",
        "www.example.org"
      ],
      "kind": "final-and-precert",
      "revoked": false,
      "logEntries": 2,
      "crtshId": 8913351873,
      "lane": 1
    },
    {
      "serial": "0faa63109307bc3d414892640ccd4d9a",
      "issuer": {
        "country": "US",
        "org": "DigiCert Inc",
        "cn": "DigiCert TLS RSA SHA256 2020 CA1"
      },
      "notBefore": "2022-03-14",
      "notAfter": "2023-03-14",
      "validDays": 365,
      "state": "expired",
      "names": [
        "example.org",
        "www.example.org"
      ],
      "kind": "final-and-precert",
      "revoked": false,
      "logEntries": 2,
      "crtshId": 6359075900,
      "lane": 1
    },
    {
      "serial": "025216e1c4998e2632aa5d1da985b43c",
      "issuer": {
        "country": "US",
        "org": "DigiCert Inc",
        "cn": "DigiCert TLS RSA SHA256 2020 CA1"
      },
      "notBefore": "2021-12-10",
      "notAfter": "2022-12-09",
      "validDays": 364,
      "state": "expired",
      "names": [
        "example.org",
        "www.example.org"
      ],
      "kind": "final-and-precert",
      "revoked": false,
      "logEntries": 2,
      "crtshId": 5813209289,
      "lane": 1
    },
    {
      "serial": "0fbe08b0854d05738ab0cce1c9afeec9",
      "issuer": {
        "country": "US",
        "org": "DigiCert Inc",
        "cn": "DigiCert TLS RSA SHA256 2020 CA1"
      },
      "notBefore": "2020-11-24",
      "notAfter": "2021-12-25",
      "validDays": 396,
      "state": "expired",
      "names": [
        "example.org",
        "www.example.org"
      ],
      "kind": "final-and-precert",
      "revoked": false,
      "logEntries": 2,
      "crtshId": 3704614715,
      "lane": 1
    },
    {
      "serial": "0fd078dd48f1a2bd4d0f2ba96b6038fe",
      "issuer": {
        "country": "US",
        "org": "DigiCert Inc",
        "cn": "DigiCert SHA2 Secure Server CA"
      },
      "notBefore": "2018-11-28",
      "notAfter": "2020-12-02",
      "validDays": 735,
      "state": "expired",
      "names": [
        "example.org",
        "www.example.org"
      ],
      "kind": "final-and-precert",
      "revoked": false,
      "logEntries": 5,
      "crtshId": 2854376823,
      "lane": 1
    },
    {
      "serial": "0e64c5fbc236ade14b172aeb41c78cb0",
      "issuer": {
        "country": "US",
        "org": "DigiCert Inc",
        "cn": "DigiCert SHA2 High Assurance Server CA"
      },
      "notBefore": "2015-11-03",
      "notAfter": "2018-11-28",
      "validDays": 1121,
      "state": "expired",
      "names": [
        "example.org",
        "www.example.org"
      ],
      "kind": "unknown",
      "revoked": false,
      "logEntries": 1,
      "crtshId": 10557607,
      "lane": 1
    },
    {
      "serial": "0411de8f53b462f6a5a861b712ec6b59",
      "issuer": {
        "country": "US",
        "org": "DigiCert Inc",
        "cn": "DigiCert SHA2 High Assurance Server CA"
      },
      "notBefore": "2014-11-06",
      "notAfter": "2015-11-13",
      "validDays": 372,
      "state": "expired",
      "names": [
        "example.org",
        "www.example.org"
      ],
      "kind": "unknown",
      "revoked": false,
      "logEntries": 1,
      "crtshId": 5857507,
      "lane": 1
    },
    {
      "serial": "1765bed9246411",
      "issuer": {
        "country": "DE",
        "org": "T-Systems SfR GmbH",
        "cn": "T-Systems SfR CA 2"
      },
      "notBefore": "2014-04-10",
      "notAfter": "2019-04-09",
      "validDays": 1825,
      "state": "expired",
      "names": [
        "[email protected]",
        "tdreg001.t-systems-sfr.com"
      ],
      "kind": "unknown",
      "revoked": false,
      "logEntries": 1,
      "crtshId": 39377559,
      "lane": 4
    },
    {
      "serial": "1765bed8b82141",
      "issuer": {
        "country": "DE",
        "org": "T-Systems SfR GmbH",
        "cn": "T-Systems SfR CA 2"
      },
      "notBefore": "2014-04-10",
      "notAfter": "2019-04-09",
      "validDays": 1825,
      "state": "expired",
      "names": [
        "[email protected]",
        "tdhost001.t-systems-sfr.com"
      ],
      "kind": "unknown",
      "revoked": false,
      "logEntries": 1,
      "crtshId": 39208913,
      "lane": 4
    },
    {
      "serial": "114b83a1",
      "issuer": {
        "country": "DE",
        "org": "Humboldt-Universitaet zu Berlin",
        "cn": "HU-CA"
      },
      "notBefore": "2011-01-11",
      "notAfter": "2016-01-10",
      "validDays": 1825,
      "state": "expired",
      "names": [
        "www.testdomain.example.org",
        "www2.hu-berlin.de"
      ],
      "kind": "unknown",
      "revoked": false,
      "logEntries": 1,
      "crtshId": 2380565475,
      "lane": 5
    }
  ],
  "next": null
}

Next step

Subdomain finderWhich names appear in these certificates?
Check example.org in Subdomain finder
SSL checkerWhich certificate is live right now?
Check example.org in SSL checker
Certificate decoderRead one certificate field by field
Open in Certificate decoder

What Certificate Transparency is

Certificate Transparency, or CT, is a set of public, append-only logs. When a certificate authority that browsers trust issues a certificate, it records it in several of these logs, and browsers such as Chrome and Safari refuse certificates that were not logged. The point is simple: if a certificate is issued for your domain, you can find out, even if you did not ask for it.

That makes CT the best public record of who has issued certificates for a name. It is how people notice a mistaken issuance, a forgotten test site that got a certificate, or a certificate authority that has been switched without telling the team.

This page searches those logs for you. Enter a domain and you get the certificates, a timeline grouped by issuer, and the numbers that matter: how many there are, how many are valid today, and how often they are renewed.

How to use it

Enter a domainType a name such as example.org. A bare name lists certificates that name it. Add a subdomain, such as www.example.org, to narrow the search to that name.
Decide about subdomainsSwitch on "Include subdomains" to list certificates for every name under the domain. It is the heavier question, so it can wait in a short queue, and the answer is kept for an hour so the next person gets it at once.
Read the timelineEach lane is one issuer and each bar is one certificate, from the day it started to the day it ends. Filled bars are valid now, outlined bars have expired. A change of lane shows a change of authority, and a gap shows a lapse.
Open a certificateEach row shows the names, the issuer, the dates, the serial number and the SHA-256 fingerprint when we have it, with a link to the entry on crt.sh.

Shell

# The same search from a terminal, as JSON
curl "https://lookupowl.com/api/v1/tools/ct-search?domain=example.org&includeSubdomains=true"

Why it asks two sources

crt.sh, run by Sectigo, is the standard way to search CT. It is free and thorough, and it is also slow and often unavailable. Cert Spotter, run by SSLMate, is fast and reports revocation, but it allows only a small number of questions.

So we ask both at once for a single name and merge what comes back. A precertificate and its final certificate, which crt.sh lists as two entries, become one row, and the "log entries" line says how many were merged. If one source does not answer, you get the other, with a note saying so. If both are down and we have a copy from an earlier search, you get that copy with its age on the page.

Both answered. The fullest result, with fingerprints and revocation where Cert Spotter returned the certificate.
One answered. The result is still useful, but wildcard and subdomain results can be missing when crt.sh is the one that failed.
A stored copy. Shown only when both are down, with how old it is.
Neither, and no copy. We say so plainly. The logs are on their side, not yours.

Reading the results

What you see	What it means
Renewal cadence	The typical number of days between issues, from the median gap of recent certificates. Short cadences such as 60 or 90 days point to automated renewal.
Two certificates at each renewal	Often an ECC and an RSA certificate issued together, so older clients can still connect.
Wildcard	A name starting with `*.` covers every name one level below it. It is the reason a subdomain list can look short.
Email address in the names	Some certificates, such as S/MIME certificates, name a person. They are shown in the list and left out of subdomain results.
Revoked	Reported by Cert Spotter. crt.sh does not report revocation, so a certificate only seen on crt.sh shows as not revoked.

Big domains have more certificates than one answer can hold. We then show the newest 100 (or the number you pick, up to 500) and say how many exist, and you can narrow the search by issuer or by date under More options.

What it cannot tell you

Logged is not the same as in use. CT shows that a certificate exists. It cannot show which one a server is serving. For that, use the SSL checker.
Private certificates are missing. Certificates from a private authority, such as a company's internal one, are not logged.
New certificates take a little while. A certificate can take a few minutes to show up after it is issued.
Very big domains are cut. An answer from the logs has a size limit, so for a domain with thousands of certificates we say the list is cut and suggest a filter.

To see the names themselves, try the subdomain finder, which reads the same certificates and lists the hosts, with where each one points now.

Questions people ask

What is crt.sh and why is this an alternative?

crt.sh is a free search over Certificate Transparency logs run by Sectigo. It is the standard tool, but it is often slow or down. This page asks crt.sh and Cert Spotter together and merges the answers, so you still get a result when one of them is not answering.

Does every certificate show up here?

No. Only certificates that were logged do, and browser-trusted authorities log nearly all of them. Certificates from private authorities are not logged, and a very new certificate can take a few minutes to appear.

Why does a certificate show 3 log entries?

A certificate is usually logged twice: first as a precertificate before issuance, then as the final certificate, and often in more than one log. We merge them into one row so a renewal is one line, and the entry count says how many were merged.

Can I search for a whole organisation?

Not here. The search is by domain name, with an option to include the names under it. Searching by organisation name needs a different kind of query that the free sources do not allow.

Why is "Include subdomains" slower?

It asks the logs for every certificate that names anything under the domain, which is far more work than one name. It uses crt.sh only, so it can wait in a short queue. The answer is kept for an hour, so a second search for the same domain is quick.

How do I find out which certificate a site is using now?

Use the SSL checker. It connects to the server and shows the certificate it really sends, with its chain and expiry. Certificate Transparency can only show what was issued.

Is the data private?

The logs are public by design, so the certificates are public. We keep a short-lived copy of each answer so repeated searches are quick, and we pace searches for the same domain to be kind to the logs.

Use it from AI, the API or the command line

Every LookupOwl tool is also a free API and an MCP tool, with no key and no account. This one is ct_search. Please be kind to the rate limits.

curl

curl "https://lookupowl.com/api/v1/tools/ct-search?q=example.org&excludeExpired=false&includeSubdomains=true"

MCP

claude mcp add --transport http lookupowl https://lookupowl.com/mcp

Description for AI agents · OpenAPI · llms.txt

Domain

DNS

Email

Network

IP and subnets

Web

Security

Make and convert

Certificate transparency search

Results for example.org

32 certificates logged for example.org

Next step

What Certificate Transparency is

How to use it

Why it asks two sources

Reading the results

What it cannot tell you

Questions people ask

Use it from AI, the API or the command line

32 certificates logged for example.org

Next step

What Certificate Transparency is

How to use it

Why it asks two sources

Reading the results

What it cannot tell you

Questions people ask

Use it from AI, the API or the command line

You might also need