The certificate ledger · Certificate Transparency, read live
Every certificate
a domain ever wore.
Since 2018 a browser will not trust a TLS certificate unless it has been logged, in public, in an append-only Certificate Transparency log. Name a domain and this reads that record back: every certificate ever issued for it, drawn as a timeline — one lane per issuing authority, one bar from the day a certificate began to the day it expires, live ones in ink and lapsed ones washed out.
The record is crt.sh’s, the search front end over the logs the certificate authorities themselves feed. crt.sh sends no cross-origin headers and can be slow, so a small relay on this site asks it and passes the answer back — the ledger can take half a minute to draw, and it says so while it waits. Nothing here is invented: what the log does not record, the page does not show.
Certificate Transparency · via crt.sh · the newest 2,000 certificates · the subdomain harvest · a timeline drawn in your browser
The ledger
Name a domain. Read its whole record.
Type a bare domain — example.com, not a URL — and the
relay reads crt.sh. The timeline lays every certificate on a lane for
its issuing authority; the list beneath it gives each one in full:
its common name, every subject-alternative name on it, its issuer,
serial and its two dates. Certificate authorities and the names on
their certificates are attacker-controllable strings, so every one is
escaped before it reaches the page.
Certificate ledger
waiting for a domain
crt.sh is a free public service and it can be slow — the ledger can take half a minute to draw.
Each bar is one certificate, from the day it began to the day it expires. Lapsed ones are washed out; the red line is today.
The names
Every hostname the certificates carried.
A certificate can cover many names at once, and the log keeps all of them. Gathered across the whole ledger and deduplicated, they are the distinct hostnames a domain’s own certificate authorities have published a certificate for — each stamped with how many certificates it appeared on. This is not a scan and not a guess: it is the record the domain’s owners created by requesting the certificates. Some of these names may no longer resolve.
The name book
Read a domain in the ledger above and its names gather here.
About
A ledger, not a scanner.
Certificate Transparency is a public, append-only log of every TLS certificate a participating authority issues. It exists so that a certificate mis-issued for your domain cannot be used quietly — the act of issuing it writes a permanent, public line. Browsers have required it since 2018, which means the logs are, in practice, a near-complete history of the certificates the web trusts. crt.sh is the long-running search front end over those logs; this page reads it through a small relay of its own, because crt.sh sends no cross-origin headers a browser could use directly.
What the ledger shows is what was logged, and that is a wider thing than what is live today. A name appears here because someone once obtained a certificate for it — a staging box, a retired service, a subdomain long since torn down. Many of these names no longer resolve, and their presence is not a claim that they do. Equally, a name kept off its certificates — behind a wildcard, or never given one — will not appear at all. The list is the certificate record, no more and no less.
Two limits, stated plainly. crt.sh is a free service on donated capacity and it has slow days; a request here waits up to thirty seconds and then reports the failure honestly rather than pretending. And a domain with an enormous history — a large CDN’s — has far more certificates than a page can usefully draw, so the relay keeps the newest two thousand by start date and marks the ledger truncated when it does. The timeline and the name book are then built from that newest slice, and the page says so above them. The domain you look up is remembered in this browser and nowhere else.