Certificate Transparency Checker
Every certificate ever issued for a domain, from the public logs.
Certificate Transparency exists because certificate authorities have issued certificates they should not have — sometimes through compromise, sometimes through process failure — and before CT there was no reliable way for a domain owner to find out. The fix was to make issuance public: every certificate a publicly trusted CA issues is appended to a tamper-evident log, and browsers reject certificates that are not logged.
That turns a private transaction into a public record you can audit. Searching the logs for your own domain shows every certificate anyone has obtained for it. Almost always this is your own history — your CA, your renewals, your hostnames. The value is entirely in the exception: a certificate from a CA you do not use, or covering a name you did not request, is evidence of a problem that would otherwise be invisible until it was used.
The logs are also a permanent record of your hostnames, which is the other half of the trade. Every name you have ever certified is published and searchable, by you and by everyone else. Treat the certificate history as public information about your infrastructure, because that is exactly what it is.
What this tool does
Full issuance history
Every logged certificate, newest first, with its issuing CA, validity window and the names it covers.
Spot what you did not order
A certificate from a CA you have never used is the signal CT exists to provide. It is how misissuance gets caught.
Issuer breakdown
Which CAs have issued for the domain and how often — an unexpected name in that list is worth explaining.
Names per certificate
The full SAN list, which is often where a forgotten hostname or an unintended internal name turns up.
Frequently asked questions
What is Certificate Transparency?
A system of public, append-only logs recording every certificate issued by publicly trusted CAs. Chrome and Safari require certificates to be logged before they will trust them, which makes issuance auditable by anyone rather than known only to the CA and the requester.
Why would a certificate exist that I did not request?
Possible causes range from benign to serious: a colleague or vendor obtained it, a CDN or hosting provider issued one on your behalf, a CA made a validation mistake, or someone passed a domain-control check they should not have. The first two are common; the last two are why CT exists.
What should I do if I find one I cannot account for?
Establish who requested it — check with your hosting, CDN and platform providers first, since automatic issuance on your behalf is the usual answer. If nobody can account for it, report it to the issuing CA, which is obliged to investigate and revoke a misissued certificate. Then check how domain control was proven, because that is the path that was abused.
Can I stop certificates being issued for my domain?
You can constrain who may issue, with a CAA DNS record naming the CAs allowed to issue for your domain. CAs are required to check it. It does not prevent a compromised or non-compliant CA from issuing, which is precisely why CT monitoring remains necessary alongside it.
Does this show expired and revoked certificates?
Expired ones, yes — the log is permanent and expiry is shown per certificate. Revocation is not recorded in CT logs, so a certificate listed here may have been revoked; that status lives in CRL and OCSP, not in the transparency logs.
Where does the data come from?
crt.sh, a free public search service run by Sectigo that aggregates the CT logs. This tool queries it and does not contact the domain being searched, so the lookup is entirely passive.
Monitor it, don't just check it
One-off checks catch what is broken today. CertNotify watches your certificates, domains, DNS and code continuously and tells you before something breaks.