Certificate Transparency search

Free, fast search for certificates from CT logs, with grouped results for easier review.

Found 2 matching certificates in 2 groups.

SAN set
chasingshadowscomic.comwww.chasingshadowscomic.com
Coverage ends (UTC)
2026-12-13 19:2351d
Issuer organization Serial Logged at (UTC) Valid until (UTC)
Let's Encrypt 06e99141a0be48b3f7760d5e3320a98cc6ad
2026-09-14 20:22
2026-12-13 19:2351d
SAN set
autodiscover.chasingshadowscomic.commail.chasingshadowscomic.com
Coverage ends (UTC)
2026-12-14 10:1551d
Issuer organization Serial Logged at (UTC) Valid until (UTC)
Let's Encrypt 060a74b0b1da3c33750d52c1daedd41a12cd
2026-09-15 11:14
2026-12-14 10:1551d

Search scope options
DNS host and subdomains

Matches certificates that cover the host or names below it, including wildcards.

Searchwww.example.com
Matcheswww.example.com*.example.comsub.www.example.comdeeper.sub.www.example.com
Does not matchbadwww.example.comwww.example.com.au
DNS subdomains only

Matches certificates with names below the host.

Searchwww.example.com
Matchessub.www.example.comdeeper.sub.www.example.com*.www.example.com
Does not matchwww.example.com*.example.com
DNS host coverage

Matches certificates that directly cover the host, including a wildcard for the parent domain.

Searchwww.example.com
Matcheswww.example.com*.example.com
Does not matchsub.www.example.combadwww.example.comwww.example.com.au
DNS SAN (exact)

Matches only an identical DNS SAN value, including literal wildcards.

Search*.example.com
Matches*.example.com
Does not matchwww.example.com*.example.com.au

Search scope options

What is Certificate Transparency?

Major browsers require publicly trusted TLS server certificates to be logged in Certificate Transparency (CT) logs. These logs are publicly readable, append-only, and tamper-proof. CT makes it possible for anyone to monitor which publicly trusted TLS server certificates are being issued.

CT logs are very large and do not provide features such as searching by domain, so CT search tools like this one collect and index their certificate data.

What can CT search tools be used for?

CT search tools can for example be used to find certificates issued for a domain, investigate unexpected certificate issuance, and discover subdomains.

CertObserver’s CT search in particular has been designed to make it easier to spot missed renewals. It does that by grouping the certificates by SAN set and sorting the groups by when their certificate coverage ends. Those are the defaults, but other grouping and sorting options are also available.

When do new certificates appear?

Publicly trusted TLS server certificates normally appear in search results within 10 minutes of being issued.

See the monitored CT logs page for current processing status.

Are pre-certificates and final certificates shown separately?

No, if both are found then they are deduplicated into a single result.

Deduplication uses the hash of the certificate’s to-be-signed data with CT-specific fields removed (TBS-no-CT SHA-256) together with the hash of the issuer’s public key (Issuer SPKI SHA-256).

Can I use this page for automated searches?

No, this page is meant for interactive use.

Contact us if you’re interested in API access or data extracts. For some use cases we might be able to help at no cost in exchange for attribution.

Can you alert me when a new certificate is issued?

Yes, our CT monitoring can alert you when new certificates are issued for your domains or their subdomains. You can receive alerts for every new certificate or only those matching your selected alert conditions.

Can you warn me before a certificate expires?

Yes, our SSL/TLS certificate monitoring can automatically discover hosts using CT logs and periodically check the certificates they actually use. You can receive expiration warnings and alerts about other issues such as hostname mismatches and incomplete certificate chains.