What is crt.sh?
crt.sh is a free certificate search run by Sectigo. Certificate authorities publish the TLS certificates they issue to public certificate transparency logs, and crt.sh collects those logs into a searchable database. You can search by an identity such as a domain name or organisation name, by a certificate fingerprint, or by a crt.sh ID, and each result shows the certificate's dates, names and issuer.
Because certificates list every hostname they cover, searching a domain often reveals subdomains, older services and the certificate authorities an organisation uses. Security teams use it to spot certificates issued for their domains that they did not expect, and researchers use it to map a site's infrastructure. An advanced search offers many more fields and options, and the site also has certificate linting tools and lists of monitored logs.
Main Features
- Search certificates by domain, organisation name, fingerprint or crt.sh ID
- Advanced search by SAN DNS name, email address, IP address, serial number and more
- Wildcard style matching, full text search and identity matching
- Options to exclude expired certificates and deduplicate precertificates
- Group results by issuer and view full certificate details
- Atom feed of results for monitoring a search
- Certificate linting with cablint, x509lint and zlint
- Lists of monitored certificate transparency logs and CA disclosures
How to Get Started with crt.sh
- Open crt.sh.
- Enter a domain name, for example example.com, and search.
- Sort the results by date and read the Common Name and Matching Identities columns to see hostnames.
- Use Advanced to filter by field or exclude expired certificates, and open a certificate to see its full details.
crt.sh Pricing
crt.sh is free to use with no account. It is run by Sectigo.
Who Should Use It?
- Security teams checking for unexpected certificates on their domains
- Penetration testers and bug bounty hunters mapping subdomains in scope
- OSINT researchers mapping a website's infrastructure
- Journalists checking when a site or service first appeared
- PKI specialists checking certificate issuance and compliance
crt.sh Alternatives
- Censys: a search engine for internet hosts and certificates.
- DNSDumpster: a free tool for mapping the DNS records and subdomains of a domain.
- ViewDNS.info: free DNS, WHOIS and IP tools, including subdomain discovery and IP history.
Frequently Asked Questions
Is crt.sh free?
Yes. crt.sh is free to use and needs no account.
Why does crt.sh show subdomains?
Every publicly trusted TLS certificate lists the hostnames it covers, and those certificates are published to public certificate transparency logs. Searching a domain on crt.sh therefore shows hostnames that have had certificates, though internal names without public certificates will not appear.
Is it legal to look up a domain on crt.sh?
Yes. Certificate transparency logs are public by design so that anyone can check what certificates have been issued. Using what you find to test or access systems is a different matter and needs the owner's permission.