Certificate Transparency
About the Certificate Transparency
The Certificate Transparency tool searches public CT logs for SSL/TLS certificates that have been issued for a given domain. Certificate Transparency is an open framework, backed by browsers and certificate authorities, in which every publicly trusted certificate must be recorded in append-only, cryptographically verifiable logs. By querying these logs you can see the full history of certificates issued for a domain, including the issuing CA, validity dates, and any subdomains that appeared in the certificate's Subject Alternative Names.
The tool queries CT log aggregators (such as crt.sh-style data sources) and returns matching certificate records for the domain and its subdomains. Because CAs are required to log certificates before browsers will trust them, the results are effectively a complete public ledger of who issued what and when. This makes it possible to enumerate subdomains that a normal DNS scan might miss, since a wildcard or named certificate often reveals hostnames that are not otherwise advertised.
Security teams use CT log searches to detect unauthorized or rogue certificates issued for their domains, an early warning sign of phishing infrastructure or a compromised CA account. Penetration testers and bug bounty hunters mine the logs for forgotten staging, admin, and internal subdomains to expand their attack surface map. Operations teams use it to inventory which CAs have issued certificates and to confirm that a newly requested certificate has been logged and is therefore browser-trusted.
Practical tips: searching the apex domain with subdomain expansion is the fastest way to discover shadow infrastructure, but expect duplicates because each renewal and each precertificate creates a separate log entry. Certificates can appear in the logs minutes to hours before they go live, so CT is also useful for spotting upcoming launches. Combine the findings with an SSL checker to inspect the live certificate currently served on each host you discover.
Frequently asked questions
- What is Certificate Transparency?
- It is a system of public, append-only logs that record every publicly trusted SSL/TLS certificate. Browsers require certificates to be logged, creating an auditable record of all issuance.
- How can CT logs reveal hidden subdomains?
- Certificates list every hostname they cover in their Subject Alternative Names. Searching CT logs surfaces those names, often exposing staging, admin, or internal subdomains that are not in public DNS listings.
- Why do I see multiple entries for the same certificate?
- Each renewal creates a new certificate, and CAs log both a precertificate and the final certificate. This produces several closely related entries for what looks like one certificate.
- Can CT logs help detect phishing or mis-issuance?
- Yes. Monitoring CT logs for certificates issued on your domain by unexpected CAs is a primary way to detect rogue or unauthorized certificates used in phishing or man-in-the-middle attacks.
Check SSL certificate validity and expiration
Get domain registration information
Check domain registration date and age
Analyze HTTP response headers
Test HTTP compression support
Check security headers configuration