# Certificate Transparency Explorer

> Every logged certificate for a domain: history, issuers, subdomains, wildcards and expiry. Searches Certificate Transparency logs (via crt.sh) for a domain and its subdomains, de-duplicates precertificates, and shows the issuance timeline, which CAs issued over time, subdomains discovered from SANs, wildcard usage, names whose certificates are expiring or expired, and a graph of certificates and the names they cover.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://certificatetransparencyexplorer.usefulweb.site/ (interactive tool at https://certificatetransparencyexplorer.usefulweb.site/tool)
- JSON API: POST https://certificatetransparencyexplorer.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://certificatetransparencyexplorer.usefulweb.site/api/v1/tool)
- OpenAPI: https://certificatetransparencyexplorer.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://certificatetransparencyexplorer.usefulweb.site/mcp - tool `certificate_transparency_explorer`

## Inputs
- mode (select): Mode
- domain (text): Domain - Also used in pasted mode to tell subdomains from other domains.
- includeSubdomains (boolean): Include subdomains (%.domain, slower)
- expiringWithinDays (integer): Warn when a name expires within
- pasted (textarea): crt.sh JSON - Pasted mode: the JSON array from https://crt.sh/?q=example.com&output=json

## Method
- Live: crt.sh JSON search for the exact domain and (optionally) %.domain, which matches every name below it; both queries run in parallel with a 20 s timeout.
- Precertificates and final certificates share issuer + serial number and are merged into one certificate; names come from the common name and SAN list.
- Per name: first/last issuance and the latest expiry over all certificates. A name is "expiring" when its newest certificate expires within the chosen window and no later certificate has been logged yet.
- Issuers are grouped by the issuer organisation (O=) per year of notBefore. "Other domains" are names on the same certificates outside the searched domain (naive last-two-labels grouping).
- The graph shows the latest 14 certificates and their names (capped at ~60 nodes).