Certificate Transparency Logs Subdomain & SSL/TLS Asset Finder

Discover all public, hidden, staging, and historical subdomains, developer environments, and API endpoints for any target domain. Powered by public Certificate Transparency (CT) logs (crt.sh) combined with concurrent live DNS A and CNAME resolution, this Actor gives penetration testers, cybersecurity analysts, B2B lead generation specialists, and DevOps engineers a comprehensive attack surface and infrastructure inventory in seconds.

---

⚡ Why Use Certificate Transparency for Subdomain Discovery?

Whenever a Certificate Authority (CA) like Let's Encrypt, DigiCert, Sectigo, or Amazon issues an SSL/TLS certificate for a domain or subdomain, cryptographic logs are publicly published to append-only Certificate Transparency logs.

Unlike active brute-force DNS scanners that query wordlists and trigger firewall blocks, CT log discovery:

1. Finds Unindexed & Staging Assets: Discovers subdomains before search engines or web crawlers can even detect them (e.g. jira.corp.domain.com, api-v2.staging.domain.com, admin-portal.domain.com).
2. Zero Residential Proxy Costs: Queries open public transparency logs directly without triggering rate limits or requiring expensive proxy pools.
3. Historical Asset Footprint: Surfaces decommissioned or unmaintained hostnames alongside active servers.
4. Instant Live DNS Verification: Evaluates each candidate host with concurrent IPv4 (A) and alias (CNAME) lookups to distinguish active servers from dormant DNS records.

---

🥊 Competitive Advantage

Feature	ct-logs-subdomain-certificate-finder	SecurityTrails	Shodan / Censys	Manual crt.sh Web UI
Pricing Model	$1.50 / 1,000 assets (Pay-Per-Event)	$99 – $499 / mo subscription	$69 – $300 / mo	Free, but no API & slow
Live DNS A/CNAME Resolution	✅ Built-in Concurrent DNS	⚠️ Partial (Paid tier)	❌ Port scan focus	❌ None (raw text only)
Wildcard Host Cleaning	✅ Automatic (*.domain -> host)	⚠️ Manual config	❌ No	❌ Raw multiline SANs
Deduplication by Freshness	✅ Keeps newest certificate	❌ None	❌ None	❌ 100+ duplicates per host
Certificate Validity Window	✅ not_before, not_after, is_expired	⚠️ Basic	✅ Yes	⚠️ Unformatted
Subdomain Depth Tagging	✅ Automatic (0=apex, 1=sub, 2=nested)	❌ No	❌ No	❌ No
API Keys & Setup	✅ Zero keys required	❌ API key required	❌ API key required	❌ No API
Export Formats	✅ JSON, CSV, Excel, XML, HTML, API	⚠️ JSON/CSV	⚠️ JSON	❌ Web page copy-paste

---

💰 Pricing — Pay-Per-Event

Pay only for the subdomain certificate records you successfully discover and enrich. Zero recurring subscription commitments:

Discovery Volume	Price (USD)	Effective Rate	Best For
100 Subdomains	$0.15	$0.0015 / asset	Single domain attack surface check
1,000 Subdomains	$1.50	$0.0015 / asset	Mid-size enterprise asset inventory
10,000 Subdomains	$15.00	$0.0015 / asset	Multi-domain B2B infrastructure scan
50,000 Subdomains	$75.00	$0.0015 / asset	Continuous attack surface management

---

🎯 Copy-Paste Input Playbooks

Playbook 1: Default Discovery (Single Domain Quick Audit)

Discovers up to 25 unique subdomains for apify.com, resolving live IP addresses and CNAME aliases:

{
  "domains": ["apify.com"],
  "resolveDns": true,
  "maxSubdomainsPerDomain": 25,
  "activeOnly": false,
  "excludeWildcards": true
}

Playbook 2: Active Attack Surface Recon (Security & Bug Bounty)

Filters out all decommissioned or inactive records, returning only live hosts with resolvable IPv4 addresses or CNAMEs:

{
  "domains": ["github.com"],
  "resolveDns": true,
  "maxSubdomainsPerDomain": 100,
  "activeOnly": true,
  "excludeWildcards": true,
  "maxItems": 100
}

Playbook 3: Multi-Domain Enterprise Portfolio Inventory

Scans multiple brand domains in a single automated batch run:

{
  "domains": [
    "stripe.com",
    "shopify.com",
    "cloudflare.com"
  ],
  "resolveDns": true,
  "maxSubdomainsPerDomain": 50,
  "activeOnly": false,
  "timeoutSec": 45,
  "maxConcurrency": 25,
  "maxItems": 150
}

---

⚙️ Input Parameters Reference

Parameter	Type	Default	Description
domains	Array<string>	["apify.com"]	List of target apex or parent domains to query across CT logs.
resolveDns	boolean	true	Concurrently query DNS A and CNAME records to verify live host activity.
maxSubdomainsPerDomain	integer	25	Maximum number of unique subdomains to discover per root domain.
activeOnly	boolean	false	When true, filters out inactive or NXDOMAIN subdomains.
excludeWildcards	boolean	true	Strips *. prefixes from SANs to extract concrete hostnames.
timeoutSec	integer	30	Request timeout in seconds for Certificate Transparency API queries.
maxConcurrency	integer	20	Thread pool size for asynchronous DNS resolution.
maxItems	integer	100	Maximum total records to return across the entire run.

---

📊 Sample Output Record

Every item pushed to the Apify dataset contains 100% of the overview transformation fields plus extended intelligence attributes:

{
  "domain": "apify.com",
  "subdomain": "blog.apify.com",
  "is_dns_active": true,
  "ip_addresses": [
    "151.101.131.7",
    "151.101.195.7",
    "151.101.3.7",
    "151.101.67.7"
  ],
  "cname_records": [
    "apify.ghost.io",
    "ghost.map.fastly.net"
  ],
  "cert_issuer": "C=US, O=Let's Encrypt, CN=YR1",
  "cert_not_before": "2026-10-03T10:08:23",
  "cert_not_after": "2027-01-01T10:08:22",
  "discovery_source": "crt.sh",
  "discovered_at": "2026-11-04T00:19:45Z",
  "is_expired": false,
  "subdomain_depth": 1,
  "cert_id": 29632949918,
  "logged_at": null,
  "is_wildcard": false
}

---

💻 Developer Integration

Python (Apify Client SDK)

from apify_client import ApifyClient

client = ApifyClient("YOUR_APIFY_API_TOKEN")

run_input = {
    "domains": ["apify.com", "openai.com"],
    "resolveDns": True,
    "maxSubdomainsPerDomain": 50,
    "activeOnly": True,
}

# Start the Actor run and wait for completion
run = client.actor("your-username/ct-logs-subdomain-certificate-finder").call(run_input=run_input)

# Fetch dataset items
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(f"[{item['subdomain']}] Active: {item['is_dns_active']} | IPs: {item['ip_addresses']} | CNAME: {item['cname_records']}")

JavaScript / Node.js

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: 'YOUR_APIFY_API_TOKEN' });

const run = await client.actor('your-username/ct-logs-subdomain-certificate-finder').call({
    domains: ['apify.com'],
    resolveDns: true,
    activeOnly: true,
    maxSubdomainsPerDomain: 25,
});

const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(`Discovered ${items.length} active subdomains:`);
items.forEach(i => console.log(`${i.subdomain} -> ${i.ip_addresses.join(', ')}`));

cURL / REST API

curl -X POST "https://api.apify.com/v2/acts/your-username~ct-logs-subdomain-certificate-finder/runs?token=YOUR_APIFY_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "domains": ["apify.com"],
    "resolveDns": true,
    "maxSubdomainsPerDomain": 25
  }'

Claude Desktop / Model Context Protocol (MCP)

Add this Actor as an automated tool in your claude_desktop_config.json:

{
  "mcpServers": {
    "apify": {
      "command": "npx",
      "args": ["-y", "@apify/mcp-server"],
      "env": {
        "APIFY_TOKEN": "YOUR_APIFY_API_TOKEN"
      }
    }
  }
}

---

🛡️ License & Disclaimers

This Actor gathers publicly published Certificate Transparency log data in compliance with RFC 6962 and performs standard DNS resolution queries. Use responsibly for legitimate security auditing, attack surface management, and technical intelligence gathering.