# Certificate Transparency Search

List the certificates logged in public Certificate Transparency logs for a domain, optionally including its subdomains. Merges Cert Spotter and crt.sh, joins each precertificate with its final certificate, and returns for each certificate its issuer, validity dates, whether it is valid now, the names it covers, whether it is revoked, its SHA-256 and serial and the number of log entries; plus a summary (count, issuers, wildcards, renewal cadence, first and last logged). Filter by issuer, date and expiry; 1 to 500 per call with a cursor. CT lists logged certificates only: private authorities do not log, and it cannot show which ones are in use on a server. Results are cached; if a source is down a stored copy is shown with its age.

**Not for:** Checking the certificate a server is using now (use ssl_check).

- Tool id: `ct-search`
- Category: security
- Execution: network
- MCP tool `ct_search` at https://lookupowl.com/mcp
- REST `GET https://lookupowl.com/api/v1/tools/ct-search` (or POST a JSON body)
- OpenAPI: https://lookupowl.com/api/openapi.json

## Input

| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| `domain` | string | yes |  | A domain name someone owns, such as example.com. Add a subdomain to narrow the search. Not a public suffix like com. min length 1, max length 253 |
| `includeSubdomains` | boolean | no | `false` | Also list certificates for names ending in .domain. This is the costly query (about three times the upstream work) and may wait in a short queue. |
| `excludeExpired` | boolean | no | `true` | Hide certificates that have expired. |
| `issuer` | string | no |  | Only certificates whose issuer name contains this text. max length 100 |
| `since` | string | no |  | Only certificates issued on or after this date (YYYY-MM-DD). max length 10 |
| `limit` | integer | no | `100` | How many certificates to return, newest first, 1 to 500. min 1, max 500 |
| `cursor` | string | no |  | Continue a long list: the `next` value from the previous answer. max length 100 |

## Output

Results are wrapped in an envelope: `tool`, `version`, `requestId`, `data`, `summary`, `meta` (cache status, timing), `permalink`. `data` has these fields:

| Field | Type | Description |
|---|---|---|
| `domain` | string |  |
| `display` | string | The domain in Unicode when it is an internationalised name; `domain` is the A-label the logs store. |
| `includeSubdomains` | boolean |  |
| `excludeExpired` | boolean |  |
| `sources` | object[] |  |
| `asOf` | string | ISO time of the data. Older than now when a stored copy is shown. |
| `stale` | boolean |  |
| `queuedMs` | integer | How long the request waited in our queue for the logs, in ms. min -9007199254740991, max 9007199254740991 |
| `summary` | object |  |
| `certificates` | object[] |  |
| `next` | string \| null | Cursor for the next page, or null. |

## Examples

### Certificates for example.org and its subdomains

```json
{"domain":"example.org","includeSubdomains":true,"excludeExpired":false,"limit":100}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/ct-search?domain=example.org&excludeExpired=false&includeSubdomains=true&limit=100'
```

Web page: https://lookupowl.com/certificate-transparency-search?q=example.org&excludeExpired=false&includeSubdomains=true

### Currently valid certificates for github.com

```json
{"domain":"github.com","includeSubdomains":false,"excludeExpired":true,"limit":25}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/ct-search?domain=github.com&excludeExpired=true&includeSubdomains=false&limit=25'
```

Web page: https://lookupowl.com/certificate-transparency-search?q=github.com&limit=25

## Web pages

- https://lookupowl.com/certificate-transparency-search

## Limits and caching

- Cost: from 1 unit up, depending on the input (a registry lookup counts every upstream request); 1 unit for a cached result. Budgets are per network and published in the `RateLimit` response headers.
- Cache: results are kept for 3600 s.
- Timeout: 45 s.

## Related tools

- [Subdomain Finder](https://lookupowl.com/tools/subdomain-find.md): Find the subdomains of a domain that appear in public certificates. Passive: we never guess names or scan anything.
- [SSL Certificate Checker](https://lookupowl.com/tools/ssl-checker.md): Check a site's SSL/TLS certificate: days until it expires, whether it is trusted, matches the host and has a complete chain.
- [Certificate and CSR Decoder](https://lookupowl.com/tools/x509-decode.md): Read a certificate, chain or CSR field by field: names, validity, key, fingerprints and lint findings. It runs in your browser.
- [DNS Lookup](https://lookupowl.com/tools/dns-lookup.md): Look up A, AAAA, MX, NS, TXT, CNAME, SOA, CAA, DS and DNSKEY records from a public resolver or the authoritative nameserver.
- [Security Headers Checker](https://lookupowl.com/tools/security-headers.md): Grade a site's HTTP security headers from A+ to F, with what each one does and the exact header to add.

## Guide: Certificate transparency search

See every publicly logged certificate for a domain, who issued each one, when, and which names it covers.

### What Certificate Transparency is

Certificate Transparency, or CT, is a set of public, append-only logs. When a certificate authority that browsers trust issues a certificate, it records it in several of these logs, and browsers such as Chrome and Safari refuse certificates that were not logged. The point is simple: if a certificate is issued for your domain, you can find out, even if you did not ask for it.

That makes CT the best public record of who has issued certificates for a name. It is how people notice a mistaken issuance, a forgotten test site that got a certificate, or a certificate authority that has been switched without telling the team.

This page searches those logs for you. Enter a domain and you get the certificates, a timeline grouped by issuer, and the numbers that matter: how many there are, how many are valid today, and how often they are renewed.

### How to use it

1. **Enter a domain**: Type a name such as `example.org`. A bare name lists certificates that name it. Add a subdomain, such as `www.example.org`, to narrow the search to that name.
2. **Decide about subdomains**: Switch on "Include subdomains" to list certificates for every name under the domain. It is the heavier question, so it can wait in a short queue, and the answer is kept for an hour so the next person gets it at once.
3. **Read the timeline**: Each lane is one issuer and each bar is one certificate, from the day it started to the day it ends. Filled bars are valid now, outlined bars have expired. A change of lane shows a change of authority, and a gap shows a lapse.
4. **Open a certificate**: Each row shows the names, the issuer, the dates, the serial number and the SHA-256 fingerprint when we have it, with a link to the entry on crt.sh.

```bash
# The same search from a terminal, as JSON
curl "https://lookupowl.com/api/v1/tools/ct-search?domain=example.org&includeSubdomains=true"
```

> **From an AI assistant** With the LookupOwl MCP server connected, ask "Which certificates were issued for example.org this year, and by whom?" The assistant calls `ct_search` and answers from the result.

### Why it asks two sources

crt.sh, run by Sectigo, is the standard way to search CT. It is free and thorough, and it is also slow and often unavailable. Cert Spotter, run by SSLMate, is fast and reports revocation, but it allows only a small number of questions.

So we ask both at once for a single name and merge what comes back. A precertificate and its final certificate, which crt.sh lists as two entries, become one row, and the "log entries" line says how many were merged. If one source does not answer, you get the other, with a note saying so. If both are down and we have a copy from an earlier search, you get that copy with its age on the page.

- **Both answered.** The fullest result, with fingerprints and revocation where Cert Spotter returned the certificate.
- **One answered.** The result is still useful, but wildcard and subdomain results can be missing when crt.sh is the one that failed.
- **A stored copy.** Shown only when both are down, with how old it is.
- **Neither, and no copy.** We say so plainly. The logs are on their side, not yours.

### Reading the results

| What you see | What it means |
|---|---|
| Renewal cadence | The typical number of days between issues, from the median gap of recent certificates. Short cadences such as 60 or 90 days point to automated renewal. |
| Two certificates at each renewal | Often an ECC and an RSA certificate issued together, so older clients can still connect. |
| Wildcard | A name starting with `*.` covers every name one level below it. It is the reason a subdomain list can look short. |
| Email address in the names | Some certificates, such as S/MIME certificates, name a person. They are shown in the list and left out of subdomain results. |
| Revoked | Reported by Cert Spotter. crt.sh does not report revocation, so a certificate only seen on crt.sh shows as not revoked. |

Big domains have more certificates than one answer can hold. We then show the newest 100 (or the number you pick, up to 500) and say how many exist, and you can narrow the search by issuer or by date under More options.

### What it cannot tell you

- **Logged is not the same as in use.** CT shows that a certificate exists. It cannot show which one a server is serving. For that, use the [SSL checker](https://lookupowl.com/ssl-checker).
- **Private certificates are missing.** Certificates from a private authority, such as a company's internal one, are not logged.
- **New certificates take a little while.** A certificate can take a few minutes to show up after it is issued.
- **Very big domains are cut.** An answer from the logs has a size limit, so for a domain with thousands of certificates we say the list is cut and suggest a filter.

To see the names themselves, try the [subdomain finder](https://lookupowl.com/subdomain-finder), which reads the same certificates and lists the hosts, with where each one points now.

### Frequently asked questions

**What is crt.sh and why is this an alternative?**

crt.sh is a free search over Certificate Transparency logs run by Sectigo. It is the standard tool, but it is often slow or down. This page asks crt.sh and Cert Spotter together and merges the answers, so you still get a result when one of them is not answering.

**Does every certificate show up here?**

No. Only certificates that were logged do, and browser-trusted authorities log nearly all of them. Certificates from private authorities are not logged, and a very new certificate can take a few minutes to appear.

**Why does a certificate show 3 log entries?**

A certificate is usually logged twice: first as a precertificate before issuance, then as the final certificate, and often in more than one log. We merge them into one row so a renewal is one line, and the entry count says how many were merged.

**Can I search for a whole organisation?**

Not here. The search is by domain name, with an option to include the names under it. Searching by organisation name needs a different kind of query that the free sources do not allow.

**Why is "Include subdomains" slower?**

It asks the logs for every certificate that names anything under the domain, which is far more work than one name. It uses crt.sh only, so it can wait in a short queue. The answer is kept for an hour, so a second search for the same domain is quick.

**How do I find out which certificate a site is using now?**

Use the [SSL checker](https://lookupowl.com/ssl-checker). It connects to the server and shows the certificate it really sends, with its chain and expiry. Certificate Transparency can only show what was issued.

**Is the data private?**

The logs are public by design, so the certificates are public. We keep a short-lived copy of each answer so repeated searches are quick, and we pace searches for the same domain to be kind to the logs.