Certificate Transparency Lookup

When a certificate is issued for a domain, it includes all the hostnames it covers in the Subject Alternative Name (SAN) field. This tool queries the crt.sh database, which aggregates data from multiple CT logs, and extracts unique hostnames from the SAN fields. This technique can reveal subdomains that may not be discoverable through DNS enumeration, including internal systems, staging environments, and forgotten assets.

The tool flags several suspicious patterns: certificates from historically compromised CAs, wildcard certificates that could indicate overly broad access, very short validity periods that might indicate testing or malicious use, certificates from unknown or untrusted CAs, and potential typosquatting domains that closely resemble your legitimate domain. Each finding includes a risk assessment to help prioritize investigation.

DV (Domain Validation) certificates only verify domain ownership and are issued quickly with minimal checks. OV (Organization Validation) certificates verify the organization identity and require documentation. EV (Extended Validation) certificates require extensive verification including legal existence, operational presence, and authorization. Higher validation levels provide more assurance but DV certificates are equally secure for encryption purposes.

You can use this tool to establish a baseline of legitimate certificates for your domains and then periodically check for new certificates. Any unexpected certificates could indicate unauthorized access to your domain verification process, a compromised CA, or an attacker attempting to intercept your traffic. Security teams often integrate CT monitoring into their threat detection workflows to catch certificate-based attacks early.

Domains with many certificates typically belong to organizations that frequently rotate certificates, use automation like Lets Encrypt with short validity periods, or operate many subdomains. CDN providers, cloud platforms, and large enterprises often have numerous certificates due to auto-renewal policies and distributed infrastructure. The tool provides CA distribution analysis to help identify patterns in certificate issuance.

The tool supports three export formats to suit different use cases. JSON export provides structured data ideal for programmatic analysis or integration with security tools. CSV export is compatible with spreadsheets and databases for reporting and trend analysis. TXT export provides a simple list of subdomains that can be used as input for other reconnaissance or vulnerability scanning tools.