crt.sh Alternative: Search Certificate Transparency Logs Here

A crt.sh query returns certificates. Most people who type "crt sh" want the hostnames inside them, so that is what the subdomain finder returns:

• Three sources, merged. Names from CT logs via crt.sh, plus HackerTarget and AlienVault OTX. The result says which source answered, so a crt.sh outage shows up as a missing source, not as an empty list.
• Wildcard DNS detection. Before listing anything, the tool resolves a few random names under your domain. If they resolve, wildcard DNS is on and you are warned that some "found" subdomains may be phantoms.
• DNS resolution. Up to 200 subdomains are resolved to IP addresses, so you can see which names are still live.
• Takeover risk. The first 20 subdomains get a CNAME lookup and an HTTP probe that looks for dangling records pointing at deprovisioned cloud services.
• CSV export of the subdomain, IP and resolution status.

For certificate details of a single host (chain, protocols, expiry, the last five CT log entries and a CAA cross-check) use the SSL checker.

crt.sh is a certificate search engine, and for certificate-level work it is the right tool:

• Individual certificates. Every logged certificate with its issuer and validity dates. We verified this today by querying its database: for a test domain it returned the issuing CA and not-before/not-after timestamps for each certificate.
• Raw SQL access. crt.sh exposes its certwatch PostgreSQL database on port 5432 to the user guest with no password. That lets you write queries no web form offers, such as all certificates from one CA for one domain.
• History. Expired and replaced certificates stay in the index, which is useful for incident timelines. Our tool shows what the sources report and what resolves now.

# crt.sh database, read-only guest access (verified 2026-10-20)
psql -h crt.sh -p 5432 -U guest certwatch

Use the database gently: it is a free shared service, so keep queries narrow and add a LIMIT.

Prices and limits below are from each vendor's own page, checked on 20 October 2026.

• SSLMate Certificate Search API. A JSON API over CT logs. The free tier allows 100 single-hostname and 10 full-domain queries per hour; the next tier is $50/month with 1,000 and 100. A limited number of unauthenticated queries per hour is allowed for personal or evaluation use.
• SSLMate Cert Spotter. Certificate monitoring rather than search: alerts on unknown certificates for your domains, from $15/month (20 endpoints) with a 30-day trial.
• Merklemap. Subdomain and certificate search with historical data. One plan at EUR 49/month covers the website and API, with 100,000 API requests included.
• Censys. Internet-wide host and certificate data. A free account gives basic visibility; paid tiers are sold through sales, and credit packages start at $100.

If you only need hostnames once, the free tools are enough. If you need an alert the day a certificate is issued for your domain, that is a monitoring product such as Cert Spotter.

A CT-derived list is a starting point for an asset inventory, not the inventory itself:

1. Fix anything flagged as a takeover risk first: remove the dangling DNS record or reclaim the resource it points to.
2. Check names that no longer resolve. Old certificates often reveal retired staging and test hosts; make sure their DNS records are really gone.
3. Run the SSL checker on hosts that still serve HTTPS, and the security headers scan on the ones facing users.
4. Add the hosts you care about as SSL monitors. The free Scout plan includes 10 monitors; see pricing for more.

Compare with other recon tools on our SecurityTrails and DNSdumpster pages.