Home / Security Tools / CT Log Search
Security Tools
Certificates issued for a domain over time.
CT Log Search queries the public Certificate Transparency logs for every TLS certificate issued for a domain over time, revealing every name a CA has validated for the domain — including wildcard and subdomain certificates.
Enter a domain name (example.org) and run the tool. The probe queries the crt.sh Certificate Transparency log search for every matching certificate.
Input: Domain — e.g. example.org.
The output lists each certificate with its issuer, the names it covers (SANs), and the issuance date. Unexpected certificates — issued by a CA you do not use, or for a subdomain you did not request — can indicate a mis-issuance or compromise and should be investigated and revoked.
→ Detect unauthorised or mis-issued certificates for your domain.
→ Audit which CAs have issued certificates for your domain.
→ Track certificate issuance history over time.
→ Find wildcard or subdomain certificates you did not know about.
CT is a public, append-only log of every TLS certificate a CA issues. It makes mis-issuance detectable: if a CA issues a certificate for your domain without your authorisation, it appears in the log and you can catch and revoke it.
Investigate immediately. Confirm whether a teammate or automation requested it. If it is unauthorised, contact the issuing CA to revoke it and report mis-issuance, then review your domain validation and account access for compromise.
Someone with control of your domain (or a CA that validated it) requested a wildcard. If you did not, treat it as a potential mis-issuance. Wildcards cover all subdomains, so an unauthorised one is high-risk.