Matches certificates that directly cover the host, including a wildcard for the parent
domain.
Searchwww.example.com
Matcheswww.example.com*.example.com
Does not matchsub.www.example.combadwww.example.comwww.example.com.au
DNS SAN (exact)
Matches only an identical DNS SAN value, including literal wildcards.
Search*.example.com
Matches*.example.com
Does not matchwww.example.com*.example.com.au
What is Certificate Transparency?
Major browsers require publicly trusted TLS server certificates to be logged in Certificate Transparency (CT) logs.
These logs are publicly readable, append-only, and tamper-proof.
CT makes it possible for anyone to monitor which publicly trusted TLS server certificates are being issued.
CT logs are very large and do not provide features such as searching by domain, so CT search tools like this one collect and index their certificate data.
What can CT search tools be used for?
CT search tools can for example be used to find certificates issued for a domain, investigate unexpected certificate issuance, and discover subdomains.
CertObserver’s CT search in particular has been designed to make it easier to spot missed renewals. It does that by grouping the certificates by SAN set and sorting the groups by when their certificate coverage ends. Those are the defaults, but other grouping and sorting options are also available.
When do new certificates appear?
Publicly trusted TLS server certificates normally appear in search results within 10 minutes of being issued.
Are pre-certificates and final certificates shown separately?
No, if both are found then they are deduplicated into a single result.
Deduplication uses the hash of the certificate’s to-be-signed data with CT-specific fields removed
(TBS-no-CT SHA-256) together with the hash of the issuer’s public key
(Issuer SPKI SHA-256).
Can I use this page for automated searches?
No, this page is meant for interactive use.
Contact us if you’re interested in API access or data extracts.
For some use cases we might be able to help at no cost in exchange for attribution.
Can you alert me when a new certificate is issued?
Yes, our CT monitoring can alert you when new certificates are issued
for your domains or their subdomains. You can receive alerts for every new certificate
or only those matching your selected alert conditions.
Can you warn me before a certificate expires?
Yes, our SSL/TLS certificate monitoring can automatically discover hosts
using CT logs and periodically check the certificates they actually use.
You can receive expiration warnings and alerts about other issues such as hostname mismatches and incomplete certificate chains.
