# Certificate Transparency Search: Find Every Certificate

> Search Certificate Transparency logs for a domain and list every public certificate issued for it and its subdomains.

Source: https://ssl.sh/tools/ct-search/
Last updated: 2026-11-10

List the certificates public CAs have issued for a domain and its subdomains, straight from Certificate Transparency logs.

CT search lists every certificate that public certificate authorities have logged for a domain. Enter `example.com` and press **Search CT logs**; the results page shows the certificates for that name and its subdomains with issuer, validity period and SANs.

## How to use it

1. Enter the registered domain, for example `example.com`. A leading `*.` is ignored.
2. Press **Search CT logs**.
3. Review the list: newest certificates first, with the CA that issued each one.

## What Certificate Transparency is

[Certificate Transparency](https://ssl.sh/glossary/certificate-transparency/) makes certificate issuance public. When a CA issues a TLS certificate it submits it to several independent logs and embeds the logs' signed receipts ([SCTs](https://ssl.sh/glossary/sct/)) in the certificate. Chrome and Apple platforms reject publicly trusted certificates without enough valid SCTs, so CAs log practically everything they issue.

## What to use it for

- **Detect unauthorised certificates**: a certificate you did not request is a red flag. Combine monitoring with [CAA records](https://ssl.sh/tools/caa-generator/) so only your chosen CAs may issue.
- **Find forgotten hosts**: old staging and admin hosts often show up in CT. Check them with the [bulk SSL checker](https://ssl.sh/tools/bulk-ssl-checker/).
- **Audit renewals**: see when each certificate was issued and by which CA, for example after moving to a new ACME client.

## Limits

CT only covers certificates from publicly trusted CAs. Certificates from your own internal CA, self-signed certificates and most client certificates never appear. Logs are public: do not put secret project names in SANs.


## FAQ

**Why do I see two entries for one certificate?**

CAs usually log a precertificate (marked with a special poison extension) before issuing the final certificate. Both are logged, so one issuance can appear twice.

**Someone issued a certificate for my domain that I did not request. What now?**

First check whether a colleague, hosting provider or CDN requested it (CDNs often issue certificates automatically). If it is truly unauthorised, contact the issuing CA to have it revoked, and publish CAA records to limit which CAs may issue.

**Can I hide subdomains from CT logs?**

Not for publicly trusted certificates: every name in the SAN list is logged. Use a wildcard certificate if you do not want individual host names to appear, or a private CA for purely internal names.