Public Certificate Transparency Lookup

Server assisted New Internet Security & Privacy

Certificate authorities log the TLS certificates they issue for the public web in public Certificate Transparency logs; Chrome and Safari require it. Enter a domain and the Mutqan server searches an index of those logs through Cert Spotter (when its key is configured on the server) or crt.sh, then lists the certificates the index has recorded, newest first, with issuer, dates and names, grouped by issuer — so a certificate you never requested, or a subdomain you forgot, stands out. A certificate that was never logged, or not yet indexed, does not appear.

Privacy: The domain, address or URL you enter is sent from the Mutqan server to the public data service named on this page (a registry, a resolver, a certificate log or a measurement network). Nothing is stored.

What is Certificate Transparency and what can its logs tell you about a domain?

Certificate Transparency (RFC 6962, RFC 9162) is a set of public, append-only logs in which certificate authorities record the TLS certificates they issue for the public web; Chrome and Safari require it and reject certificates that were not logged. Searching an index of the logs for a domain shows the certificates recorded for it — the issuers, dates and names — which reveals mis-issued certificates and also makes every subdomain on a logged certificate public. A certificate that was never logged, or not yet indexed, does not appear.

Security note: Host names on a public certificate cannot be kept secret: never rely on an unlisted subdomain name to hide an admin panel or a staging site.

How to use Public Certificate Transparency Lookup

  1. Enter the domain (example.com); a URL or a leading *. is reduced to the domain.
  2. Keep "Include subdomains" ticked to see every name under the domain, choose how many certificates to list, and press Search CT logs.
  3. Read the Issuers table first: every issuer should be a certificate authority that you or your hosting provider actually use.
  4. Scan the names for hosts you do not know, and the certificates for recent ones nobody requested.

Public Certificate Transparency Lookup features

  • Searches an index of the public Certificate Transparency logs for the certificates logged for a domain — and, if you want, for every name under it — newest first
  • Shows each certificate's validity dates, issuer, the names it covers and its SHA-256 fingerprint when the source provides one
  • Groups the listing by issuer, so a certificate authority you never use stands out
  • Lists every distinct host name the certificates cover — the subdomains the logs make public — including wildcard names
  • Marks each certificate Current, Expired, Not yet valid or Revoked (revocation only when Cert Spotter reports it), from its dates at the moment you run the search
  • Uses Cert Spotter when the Mutqan server holds its key and crt.sh otherwise, and says which source answered and how old the listing is

Inputs and outputs

Inputs

  • Domain — a domain name such as example.com; a URL or a leading *. is reduced to the domain. IP addresses are refused.
  • Include subdomains — on by default; off lists only certificates that name the domain itself.
  • Certificates to list — 25, 50 or 100, newest first.

Outputs

  • Summary — how many certificates were listed, how many are current or expired, the distinct names, the issuers and the source that answered.
  • Issuers — each certificate authority with its number of certificates and its most recent issue date.
  • Certificates — validity dates, status, issuer, the first names covered and the SHA-256 fingerprint when available.
  • Names seen in certificates, Listing details and What to look for — every distinct name (up to 300), the source, completeness and age of the listing, and what deserves a closer look.

Public Certificate Transparency Lookup example

Certificates logged for a domain and its subdomains

Input:

example.org · Include subdomains: on · Certificates to list: 50

Output:

Certificates listed 7 · Current 2 · Expired 5 · Distinct names 5 · Issuers 2 · Source crt.sh
Issuers: R11 — 5 (most recent 2026-09-02) · Sectigo RSA Domain Validation Secure Server CA — 2 (most recent 2025-11-20)
2026-09-02 → 2026-12-01 · Current · R11 · example.org, www.example.org
2026-08-20 → 2026-11-18 · Current · R11 · staging.example.org
2026-06-04 → 2026-09-02 · Expired · R11 · example.org, www.example.org
Names seen in certificates: example.org, mail.example.org, staging.example.org, vpn.example.org, www.example.org

How to read the Public Certificate Transparency Lookup results

An unfamiliar issuer, or a recent certificate nobody on your team requested, is what CT logs exist to reveal: ask your providers first, and if nobody requested it, contact the issuing authority to have it revoked.

"Current" means today falls between the certificate's start and end dates. It says nothing about whether a server presents it, or whether it is trusted or revoked.

Many certificates for the same names usually reflect automatic renewal (every 60–90 days with ACME); several issuers at once usually means a CDN, a hosting platform or a migration.

"More exist than are shown" means the listing stopped at the limit or where the search ended: raise the limit or search a more specific name.

When to use Public Certificate Transparency Lookup

  • Auditing which certificate authorities issue certificates for your domains before publishing CAA records.
  • Discovering forgotten subdomains and hosts whose names their certificates made public.
  • Investigating a suspected mis-issued certificate, or one issued for a look-alike of your brand's domain.
  • Confirming that a renewal was issued and logged before the old certificate expires.

Troubleshooting

  • "The certificate transparency logs cannot be searched right now": crt.sh did not answer (it often does not under load) and Cert Spotter is not configured or failed too. Wait a few minutes and try again.
  • "This domain has more certificates than one answer can carry": untick Include subdomains, or search a specific host name such as www.example.com.
  • A certificate issued minutes ago is missing: logs and their indexes take time to show new entries, and listings are cached for 15 minutes to an hour.
  • No certificates at all: the name may never have had a publicly trusted certificate, may be misspelled, or may use only a private CA whose certificates are not logged.

Frequently asked questions about Public Certificate Transparency Lookup

What is Certificate Transparency?

A system of public, append-only logs in which certificate authorities record the TLS certificates they issue for the public web. Chrome and Safari require it and reject a certificate that was not logged. The search shows the certificates the index has recorded: one that was never logged, or not yet indexed, will not appear, and the listing is capped at 100.

Why does my domain show certificates I do not recognise?

Often they are legitimate: your CDN, hosting platform or e-mail provider may issue certificates for your names, and every renewal adds an entry every few months. Compare the issuer and date with your providers; if nobody requested it, contact the issuing authority to have it revoked.

Is a "Current" certificate the one my site uses?

Not necessarily. "Current" only means today falls between its start and end dates. A site can have several current certificates (renewals, other servers, a CDN) and presents only one of them; check the live certificate with a TLS checker.

Why can anyone see my subdomains here?

Because every name on a logged certificate is public in the logs, and certificates for the public web are logged so that Chrome and Safari accept them. A wildcard certificate (*.example.com) hides individual host names, at the cost of one key covering them all.

Which data source does the tool use?

Cert Spotter by SSLMate when its key is configured on the Mutqan server, otherwise crt.sh. The results say which one answered and when the listing was fetched.

Technical notes

Certificate Transparency (RFC 6962; version 2 is RFC 9162) is a set of public, append-only logs. Certificate authorities log the certificates they issue for the public web, or a precertificate before issuing one; Chrome and Safari require it and reject a certificate without proof of logging, though not every TLS client checks. The search shows the certificates the index has recorded — a certificate that was never logged, or not yet indexed, will not appear.

Two sources are used. Cert Spotter (SSLMate) is queried when its API key is configured on the Mutqan server, page by page up to the limit, and its answer is cached for 15 minutes; otherwise, or when it fails, crt.sh (operated by Sectigo) is queried and cached for an hour. crt.sh is a best-effort public service that is often slow; when neither answers, the tool says so.

Status is computed in your browser from each certificate's notBefore and notAfter dates at the time of the run. "Revoked" appears only when Cert Spotter reports it — crt.sh listings carry no revocation data here — and nothing checks a certificate's signature or trust.

With "Include subdomains" the search covers the domain and every name below it, wildcard entries included. A domain with very many certificates can exceed what the source returns in one answer (crt.sh has no paging); the tool then asks for a narrower search instead of showing a partial list as complete.

Limitations and methodology

The source is a third-party index of the logs, not the logs themselves; crt.sh in particular is best-effort and can be slow, partial or unavailable. Listings are cached on the Mutqan server for 15 minutes (Cert Spotter) or an hour (crt.sh).

Only certificates their authority logged can appear. Certificates from private or internal CAs, self-signed certificates and others outside the public web PKI are not logged, so they are not visible here.

At most 100 certificates are listed per search, newest first; older history needs a narrower search or the source's own website.

Security and privacy

The domain is sent to the Mutqan server, which passes it to Cert Spotter or crt.sh; nothing is stored beyond the short-lived cache of the listing. Everything shown is public data that anyone can look up.

References

  • RFC 6962: Certificate TransparencyIETF · 2013The original Certificate Transparency protocol: public, append-only Merkle-tree logs, signed certificate timestamps and precertificates — the version browsers enforce today.
  • RFC 9162: Certificate Transparency Version 2.0IETF · 2021Version 2 of the protocol, which refines the log data structures and how clients verify that a certificate was logged.
  • How Certificate Transparency WorksCertificate Transparency project (Google)How certificate authorities, logs, monitors and browsers fit together, and how domain owners use monitors to spot mis-issued certificates.