Check
Certificate Transparency search
List the certificates public CAs have issued for a domain and its subdomains, straight from Certificate Transparency logs.
CT search lists every certificate that public certificate authorities have logged for a domain. Enter example.com and press Search CT logs; the results page shows the certificates for that name and its subdomains with issuer, validity period and SANs.
How to use it
- Enter the registered domain, for example
example.com. A leading*.is ignored. - Press Search CT logs.
- Review the list: newest certificates first, with the CA that issued each one.
What Certificate Transparency is
Certificate Transparency makes certificate issuance public. When a CA issues a TLS certificate it submits it to several independent logs and embeds the logs' signed receipts (SCTs) in the certificate. Chrome and Apple platforms reject publicly trusted certificates without enough valid SCTs, so CAs log practically everything they issue.
What to use it for
- Detect unauthorised certificates: a certificate you did not request is a red flag. Combine monitoring with CAA records so only your chosen CAs may issue.
- Find forgotten hosts: old staging and admin hosts often show up in CT. Check them with the bulk SSL checker.
- Audit renewals: see when each certificate was issued and by which CA, for example after moving to a new ACME client.
Limits
CT only covers certificates from publicly trusted CAs. Certificates from your own internal CA, self-signed certificates and most client certificates never appear. Logs are public: do not put secret project names in SANs.
FAQ
Why do I see two entries for one certificate?
CAs usually log a precertificate (marked with a special poison extension) before issuing the final certificate. Both are logged, so one issuance can appear twice.
Someone issued a certificate for my domain that I did not request. What now?
First check whether a colleague, hosting provider or CDN requested it (CDNs often issue certificates automatically). If it is truly unauthorised, contact the issuing CA to have it revoked, and publish CAA records to limit which CAs may issue.
Can I hide subdomains from CT logs?
Not for publicly trusted certificates: every name in the SAN list is logged. Use a wildcard certificate if you do not want individual host names to appear, or a private CA for purely internal names.