# crtlog v0.4.0 (2026-08-02)

> crtlog is a Certificate Transparency search engine. It indexes certificates from public CT logs (RFC 6962 and Sunlight) and resolves their SANs to IP addresses, enabling domain-to-IP and IP-to-domain historical lookups.

Key facts:
- Free for anonymous users (20 searches/day, 1/5s rate limit).
- API keys raise limit to 500 searches/day — request via contact@crtlog.com.
- Tor .onion access available with API key.
- Source: Rust (axum + rusqlite + FTS5), SQLite backend, Docker.
- DNS resolution via Unbound (local recursive resolver).
- Daily gzipped SQLite backup to self-hosted S3-compatible object storage with encryption, located in Europe.
- No accounts, no tracking, no analytics.
- Newly expired certificates are not stored: certificates whose validity period
  has already ended are skipped during ingestion, keeping the index focused on
  live or recently valid domains.

## CT Logs Indexed (8)

- Google Argon 2026 H2 (RFC 6962)
- Google Argon 2027 H1 (RFC 6962)
- Google Xenon 2026 H2 (RFC 6962)
- Google Xenon 2027 H1 (RFC 6962)
- Cloudflare Nimbus 2026 (RFC 6962)
- Cloudflare Nimbus 2027 (RFC 6962)
- Let's Encrypt Sycamore 2026 H2 (Sunlight)
- Let's Encrypt Sycamore 2027 H1 (Sunlight)

## API

- [API reference](https://crtlog.com/docs): Full API docs with examples.
- [GET /api/v1/cert/{sha256}](https://crtlog.com/docs#get-apiv1-cert): Fetch a certificate by SHA-256 fingerprint.
- [GET /api/v1/query](https://crtlog.com/docs#get-apiv1-query): Search certificates by domain, subdomain, IP, or wildcard. Supports lite and wildcard params.
- [GET /api/v1/domain-ips](https://crtlog.com/docs#get-apiv1-domain-ips): Historical IPs a domain's SANs resolved to.
- [GET /api/v1/log/stats](https://crtlog.com/docs#get-apiv1-log-stats): CT log ingestion progress.
- [GET /api/v1/db/stats](https://crtlog.com/docs#get-apiv1-db-stats): Database size and record counts.
- [GET /api/v1/storage](https://crtlog.com/docs#get-apiv1-storage): S3 backup size and status.
- [GET /api/v1/system_status](https://crtlog.com/docs#get-apiv1-system-status): System health, last ingest, resolver coverage.
- [POST /api/v1/submit](https://crtlog.com/docs#post-apiv1-submit): Submit a domain for live cert fetch + resolution (API key).
- [GET /api/v1/submission/{tracking_id}](https://crtlog.com/docs#get-apiv1-submission): Check submission status.
- [GET /api/v1/submissions](https://crtlog.com/docs#get-apiv1-submissions): List recent submissions.
- [GET /api/v1/submissions/recent](https://crtlog.com/docs#get-apiv1-submissions-recent): Check if a domain was recently submitted.

### Example: regular domain search

```
curl 'https://crtlog.com/api/v1/query?q=example.com'
```

### Example: include subdomains

```
curl 'https://crtlog.com/api/v1/query?q=example.com&include_wildcard=true'
```

### Example: search by IP (lite mode)

```
curl 'https://crtlog.com/api/v1/query?q=192.0.2.1&lite=true'
```

### Example: search by IP with wildcard certificates included

```
curl 'https://crtlog.com/api/v1/query?q=192.0.2.1&lite=true&include_wildcard=true'
```

### Auth header format

```
Authorization: Bearer <api_key>
```

All authenticated endpoints require this header. API keys are 43-character base64url-encoded strings. Request one via email.

## Web UI

- [Home](https://crtlog.com/): Search interface.
- [Status](https://crtlog.com/status): System health and ingest activity.
- [Coverage](https://crtlog.com/coverage): Resolver coverage.
- [Stats](https://crtlog.com/stats): Database and backup statistics.
- [Submit](https://crtlog.com/submit): Domain submission form.

## Legal

- [Terms of Service](https://crtlog.com/legal/terms)
- [Privacy Policy](https://crtlog.com/legal/privacy)
- [Report Abuse](https://crtlog.com/legal/abuse)
- [security.txt](https://crtlog.com/security.txt)