crt.sh

OVERVIEW

crt.sh is a searchable web front end over the public certificate transparency (CT) logs that browsers now require CAs to publish every certificate into. Every TLS certificate issued for a domain — including those covering subdomains via the Subject Alternative Name (SAN) field — shows up here, which makes the log a very effective passive inventory of hosts an organization has stood up over time.

The UI takes a domain and renders the matching certificates in a table; the same data can also be queried directly with the percent operator against the API to drop results into a recon pipeline.

USE CASES

Practical use cases

• 01

  Getting a first subdomain list at the very start of a domain-scoped engagement, before any active probing.

• 02

  Finding forgotten or staging subdomains that DNS enumeration misses but were once covered by a cert.

• 03

  Cross-checking results from brute-force and recursive DNS tools to expand coverage.

• 04

  Pulling CA, issuer, and validity-period metadata for findings that need to cite the issuing authority.

QUICK START

At the very start of a domain-scoped engagement, as a passive way to enumerate subdomains before any active DNS or HTTP probing.

1. Open crt.sh and search for the in-scope domain (e.g. target.com) using the percent operator to match subdomains.
2. Scrape the returned certificate table, or call the JSON endpoint with the same query to feed a script.
3. Filter out duplicates, wildcards, and any subdomains that clearly fall outside scope before passing the list on.
4. Hand the cleaned list to a live-host check or to an active tool like Amass for confirmation.

curl -s "https://crt.sh/?q=%25target.com&output=json" | jq -r ".[].name_value" | sort -u

BEFORE YOU RUN IT

What to check before running it