usefulweb.site Certificate Transparency Explorer

Internet infrastructure explorers

Certificate Transparency Explorer

Every logged certificate for a domain: history, issuers, subdomains, wildcards and expiry.

Also used in pasted mode to tell subdomains from other domains.

days

Pasted mode: the JSON array from https://crt.sh/?q=example.com&output=json

Try an example: Pasted crt.sh results for example.net

How it works

Searches Certificate Transparency logs (via crt.sh) for a domain and its subdomains, de-duplicates precertificates, and shows the issuance timeline, which CAs issued over time, subdomains discovered from SANs, wildcard usage, names whose certificates are expiring or expired, and a graph of certificates and the names they cover.

  • Live: crt.sh JSON search for the exact domain and (optionally) %.domain, which matches every name below it; both queries run in parallel with a 20 s timeout.
  • Precertificates and final certificates share issuer + serial number and are merged into one certificate; names come from the common name and SAN list.
  • Per name: first/last issuance and the latest expiry over all certificates. A name is "expiring" when its newest certificate expires within the chosen window and no later certificate has been logged yet.
  • Issuers are grouped by the issuer organisation (O=) per year of notBefore. "Other domains" are names on the same certificates outside the searched domain (naive last-two-labels grouping).
  • The graph shows the latest 14 certificates and their names (capped at ~60 nodes).

For scripts and AI agents

  • JSON API: POST https://certificatetransparencyexplorer.usefulweb.site/api/v1/calculate (same calculation as this page)
  • Interface description: OpenAPI 3.1 · AI guide: llms.txt
  • MCP server (Streamable HTTP): https://certificatetransparencyexplorer.usefulweb.site/mcp · tool name certificate_transparency_explorer
Example request
curl -s -X POST https://certificatetransparencyexplorer.usefulweb.site/api/v1/calculate \
  -H 'content-type: application/json' \
  -d '{…see OpenAPI examples…}'

Related tools

  • DNS + Certificate Explorer – DNS records, e-mail security, CAA, live TLS certificate and CT history for a domain.
  • Global DNS Explorer – Ask every authoritative name server and public resolvers: records, propagation, DNSSEC, mistakes.
Feedback