Tools / Certificate Transparency
What do the certificate logs say about you?
Every publicly trusted certificate is written to a public log before a browser will accept it. That makes the logs a complete, searchable history of every host name your organisation has ever put behind HTTPS. Enter a domain and see that history the way an attacker does — then see which of it is still live, still yours, and still pointing where it should.
Host names · Issuers · CAA · Expiry · Private addresses · Recent issuanceFree · No sign-up · PDF report
What it checks
Every name that ever had a certificate
Public certificates are logged by law of the browser vendors, so the logs hold every host name an organisation has ever put behind HTTPS — the ones a DNS wordlist would never guess, and the ones somebody forgot.
Which still exist
Each name is looked up in DNS. Names with a current certificate and no DNS record are stale; names that resolve to private addresses are internal systems advertised in public.
Who issued, and were they allowed to
Issuing authorities over the domain's history, the ones with current certificates, and a comparison with the CAA records so issuance outside policy stands out.
What is about to run out
Certificates for live names expiring within a week or a month, so a lapsed renewal is caught before the browser warnings start.
What was issued recently
Everything from the last thirty days, with the names that do not yet resolve called out: the earliest sign of a new service, or of one you did not order.
The attacker's view
Names suggesting remote access, management consoles and pre-production systems are grouped, because those are what the logs get read for.
Why this matters
Certificate transparency was built so that a mis-issued certificate could not stay hidden, and it works: every authority must log what it issues, and browsers refuse certificates that are not logged. The side effect is that the logs are also the best free reconnaissance source on the internet. Before a penetration tester runs a single scan, they read the logs, and so does everyone else.
Reading your own is the point of this tool. The certificate from three years ago for a staging system, the wildcard somebody obtained for a project, the VPN gateway whose name nobody thought of as public: they are all there. So is the certificate issued yesterday for a name you did not order, which is the case a monitor exists for. This tool gives you the snapshot; the managed SOC watches the logs continuously for clients and tells them the day something new appears.
The data comes from the crt.sh search over the public logs, with Cert Spotter as a fallback when crt.sh is busy. Both are shared public services, so the occasional slow run is theirs rather than ours.
Also in Tools