crtlog is a free public search engine for Certificate Transparency logs. Every TLS certificate issued by a public Certificate Authority is recorded in CT logs. crtlog ingests those logs, indexes the domains they contain, and lets you search them.
Unlike most CT lookup tools, crtlog also resolves and stores the IP addresses historically associated with a certificate's domains. You can see not only that a certificate existed, but where the domain pointed at the time it was observed.
What you can do here
- Search by domain, subdomain, wildcard fragment, or resolved IP address at /. IP search returns every certificate whose SAN resolved to that IP at any time since we started resolving it; a shared hosting or CDN IP can match many unrelated domains.
- Look up any certificate by its SHA-256 fingerprint:
/api/v1/cert/{sha256}. - View issuer, validity period, SANs, and resolved IP history.
- Download up to 1,000 results as CSV or JSON from the search page; each export counts as one search request against your daily limit.
- Check database size, CT log progress, and backup health at /stats.
- Monitor system health and recent ingest activity at /status.
- Submit a live domain with an API key and have crtlog fetch its certificate, store it, and resolve its SANs to IPs: /submit. Each submission consumes one fetch and is capped at 30 submissions per 24 hours per API key.
Usage limits
Anonymous browser users can make 20 searches per day, with at most one search every 5 seconds.
Results are capped at 1,000 certificates per request and support pagination.
Scripted access (curl, wget, python-requests) requires an API key which raises the limit to
500 searches per day. A .onion (Tor) endpoint is also available — contact us to request the address. See the API docs for details.
Data freshness
Newly expired certificates are not stored. When crtlog ingests CT logs, it skips certificates whose validity period has already ended. This keeps the index focused on live or recently valid domains and avoids resolver noise on dead names.
Privacy and data
crtlog only indexes data that is already published in public Certificate Transparency logs. We do not expose per-certificate first-seen timestamps or other operational metadata; we only publish bounded aggregate telemetry. Anonymous rate limits use the client IP address, but it is checked in memory and never stored in logs or the database. For a sense of scale, tracking one million unique daily visitors in memory uses roughly 150–250 MB of RAM. For details, see Privacy and Terms.
Contact: