CRT.sh

CRT.sh is a certificate transparency log search engine that provides comprehensive visibility into SSL/TLS certificates issued for domains worldwide.

Certificate Intelligence Certificate Transparency Subdomain Discovery Historical Certificate Data

Overview

CRT.sh is a powerful certificate transparency log search engine that enables users to query and analyze SSL/TLS certificates issued by Certificate Authorities worldwide. The platform aggregates data from multiple public certificate transparency logs, providing comprehensive visibility into domain certificate history, subdomain discovery, and certificate issuance patterns. CRT.sh is widely used by security researchers, penetration testers, and threat intelligence analysts for identifying subdomains, discovering shadow IT infrastructure, and investigating SSL certificate-related intelligence.

Primary Use Cases

✔ Discovering subdomains by querying certificate transparency logs for SSL/TLS certificate issuance.

✔ Investigating shadow IT infrastructure by identifying certificates issued for unauthorized domains.

✔ Tracking certificate issuance patterns to identify phishing domains and malicious infrastructure.

Frequently Asked Questions

CRT.sh is a certificate transparency log search engine that aggregates SSL/TLS certificate data from public certificate transparency logs. It works by querying these logs to return all certificates issued for a domain, including subdomains, allowing users to discover certificate history and identify related infrastructure.

Yes, CRT.sh is completely free to use with no registration or subscription required. Users can perform unlimited searches and access historical certificate data without any restrictions or costs. The platform is supported by the certificate transparency community.

CRT.sh queries multiple public certificate transparency logs including Google's, Cloudflare's, DigiCert's, and Sectigo's logs. By aggregating data from multiple sources, CRT.sh provides comprehensive coverage of SSL/TLS certificates issued by Certificate Authorities globally.

CRT.sh is valuable for subdomain discovery because every SSL/TLS certificate issued for a subdomain is recorded in certificate transparency logs. By querying CRT.sh for a domain, users can discover all subdomains that have SSL certificates, including hidden or forgotten subdomains that may expose attack surface.

CRT.sh provides valuable security intelligence including subdomain enumeration, discovery of expired certificates that may pose security risks, detection of certificates issued for phishing domains, mapping of organizational infrastructure, tracking certificate issuance patterns, and identifying shadow IT deployed within an organization.