Pricing

from $2.00 / 1,000 hosts

Try for free

Go to Apify Store

crt.sh Subdomain Finder - Certificate Search

Try for free

Find every subdomain of a domain from public Certificate Transparency logs (crt.sh), one row per host: days until certificate expiry, issuer, environment inferred from the name (staging, dev, production) and first-seen date. Asset inventory, no API key.

Pricing

from $2.00 / 1,000 hosts

Rating

0.0

(0)

Developer

Tom Awake

Actor stats

Bookmarked

Total users

Monthly active users

21 hours ago

Last modified

Categories

Developer tools

SEO tools

MCP servers

You can access the crt.sh Subdomain Finder - Certificate Search programmatically from your own applications by using the Apify API. You can also choose the language preference from below. To use the Apify API, you’ll need an Apify account and your API token, found in API & Integrations in Apify Console.

Python

JavaScript

CLI

OpenAPI

HTTP

MCP

{
  "openapi": "3.0.1",
  "info": {
    "version": "0.1",
    "x-build-id": "SgWjQfXXCArW1iHC6"
  },
  "servers": [
    {
      "url": "https://api.apify.com/v2"
    }
  ],
  "paths": {
    "/acts/dataio~crtsh-subdomain-finder/run-sync-get-dataset-items": {
      "post": {
        "operationId": "run-sync-get-dataset-items-dataio-crtsh-subdomain-finder",
        "x-openai-isConsequential": false,
        "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.",
        "tags": [
          "Run Actor"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/inputSchema"
              }
            }
          }
        },
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Enter your Apify token here"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          }
        }
      }
    },
    "/acts/dataio~crtsh-subdomain-finder/runs": {
      "post": {
        "operationId": "runs-sync-dataio-crtsh-subdomain-finder",
        "x-openai-isConsequential": false,
        "summary": "Executes an Actor and returns information about the initiated run in response.",
        "tags": [
          "Run Actor"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/inputSchema"
              }
            }
          }
        },
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Enter your Apify token here"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/runsResponseSchema"
                }
              }
            }
          }
        }
      }
    },
    "/acts/dataio~crtsh-subdomain-finder/run-sync": {
      "post": {
        "operationId": "run-sync-dataio-crtsh-subdomain-finder",
        "x-openai-isConsequential": false,
        "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.",
        "tags": [
          "Run Actor"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/inputSchema"
              }
            }
          }
        },
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Enter your Apify token here"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "inputSchema": {
        "type": "object",
        "required": [
          "domains"
        ],
        "properties": {
          "domains": {
            "title": "Domains",
            "minItems": 1,
            "maxItems": 50,
            "type": "array",
            "description": "One or more domains, for example shopify.com. Subdomains are included automatically, so there is no need to list them. URLs and leading wildcards are accepted and cleaned up. Up to 50 domains per run.",
            "items": {
              "type": "string"
            }
          },
          "mode": {
            "title": "Output shape",
            "enum": [
              "hosts",
              "certificates"
            ],
            "type": "string",
            "description": "One row per host is the inventory: every certificate for a host is merged into a single line with its expiry, issuer and history. One row per certificate keeps each certificate separate, for audit trails and issuance timelines.",
            "default": "hosts"
          },
          "activeOnly": {
            "title": "Currently valid certificates only",
            "type": "boolean",
            "description": "On by default, and faster: one query instead of two. Turning it off adds the historical record, which on shopify.com raises the inventory from 469 hosts to 627 — including hosts whose certificates have lapsed, often the most interesting ones.",
            "default": true
          },
          "expiringWithinDays": {
            "title": "Expiring within (days)",
            "minimum": 0,
            "maximum": 3650,
            "type": "integer",
            "description": "Keep only hosts expiring within this many days. 30 is the usual renewal window. Leave empty to keep everything."
          },
          "environments": {
            "title": "Environments",
            "type": "array",
            "description": "Filter by the environment inferred from the hostname. Leave empty for all. Staging, Development and Internal together are the shadow estate: 170 of 627 hosts on shopify.com.",
            "items": {
              "type": "string",
              "enum": [
                "Production",
                "Staging",
                "Development",
                "Internal",
                "Mail"
              ],
              "enumTitles": [
                "Production",
                "Staging",
                "Development",
                "Internal",
                "Mail"
              ]
            }
          },
          "includeWildcards": {
            "title": "Include wildcard certificates",
            "type": "boolean",
            "description": "Wildcard entries such as *.example.com are real inventory but cover an unknown number of hosts. 5% of rows on shopify.com.",
            "default": true
          },
          "includeRelatedDomains": {
            "title": "Include names outside the searched domain",
            "type": "boolean",
            "description": "A certificate often covers several unrelated domains at once. Turning this on keeps those names, which is how sister brands and shared hosting providers surface. Off by default, because it widens the result beyond what you asked for.",
            "default": false
          },
          "maxItems": {
            "title": "Maximum rows",
            "minimum": 1,
            "maximum": 50000,
            "type": "integer",
            "description": "If the inventory is larger, rows closest to expiry are kept first, so truncation never removes what you were looking for.",
            "default": 1000
          }
        }
      },
      "runsResponseSchema": {
        "type": "object",
        "properties": {
          "data": {
            "type": "object",
            "properties": {
              "id": {
                "type": "string"
              },
              "actId": {
                "type": "string"
              },
              "userId": {
                "type": "string"
              },
              "startedAt": {
                "type": "string",
                "format": "date-time",
                "example": "2025-01-08T00:00:00.000Z"
              },
              "finishedAt": {
                "type": "string",
                "format": "date-time",
                "example": "2025-01-08T00:00:00.000Z"
              },
              "status": {
                "type": "string",
                "example": "READY"
              },
              "meta": {
                "type": "object",
                "properties": {
                  "origin": {
                    "type": "string",
                    "example": "API"
                  },
                  "userAgent": {
                    "type": "string"
                  }
                }
              },
              "stats": {
                "type": "object",
                "properties": {
                  "inputBodyLen": {
                    "type": "integer",
                    "example": 2000
                  },
                  "rebootCount": {
                    "type": "integer",
                    "example": 0
                  },
                  "restartCount": {
                    "type": "integer",
                    "example": 0
                  },
                  "resurrectCount": {
                    "type": "integer",
                    "example": 0
                  },
                  "computeUnits": {
                    "type": "integer",
                    "example": 0
                  }
                }
              },
              "options": {
                "type": "object",
                "properties": {
                  "build": {
                    "type": "string",
                    "example": "latest"
                  },
                  "timeoutSecs": {
                    "type": "integer",
                    "example": 300
                  },
                  "memoryMbytes": {
                    "type": "integer",
                    "example": 1024
                  },
                  "diskMbytes": {
                    "type": "integer",
                    "example": 2048
                  }
                }
              },
              "buildId": {
                "type": "string"
              },
              "defaultKeyValueStoreId": {
                "type": "string"
              },
              "defaultDatasetId": {
                "type": "string"
              },
              "defaultRequestQueueId": {
                "type": "string"
              },
              "buildNumber": {
                "type": "string",
                "example": "1.0.0"
              },
              "containerUrl": {
                "type": "string"
              },
              "usage": {
                "type": "object",
                "properties": {
                  "ACTOR_COMPUTE_UNITS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_WRITES": {
                    "type": "integer",
                    "example": 1
                  },
                  "KEY_VALUE_STORE_LISTS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_INTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_EXTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_SERPS": {
                    "type": "integer",
                    "example": 0
                  }
                }
              },
              "usageTotalUsd": {
                "type": "number",
                "example": 0.00005
              },
              "usageUsd": {
                "type": "object",
                "properties": {
                  "ACTOR_COMPUTE_UNITS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_WRITES": {
                    "type": "number",
                    "example": 0.00005
                  },
                  "KEY_VALUE_STORE_LISTS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_INTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_EXTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_SERPS": {
                    "type": "integer",
                    "example": 0
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

Subdomain Finder - crt.sh Certificate Transparency OpenAPI definition

OpenAPI is a standard for designing and describing RESTful APIs, allowing developers to define API structure, endpoints, and data formats in a machine-readable way. It simplifies API development, integration, and documentation.

OpenAPI is effective when used with AI agents and GPTs by standardizing how these systems interact with various APIs, for reliable integrations and efficient communication.

By defining machine-readable API specifications, OpenAPI allows AI models like GPTs to understand and use varied data sources, improving accuracy. This accelerates development, reduces errors, and provides context-aware responses, making OpenAPI a core component for AI applications.

You can download the OpenAPI definitions for crt.sh Subdomain Finder - Certificate Search from the options below:

OpenAPI.json

If you’d like to learn more about how OpenAPI powers GPTs, read our blog post.

You can also check out our other API clients:

crt.sh Subdomain Finder - Certificate Search API in Python

crt.sh Subdomain Finder - Certificate Search API in JavaScript

crt.sh Subdomain Finder - Certificate Search API through CLI

crt.sh Subdomain Finder - Certificate Search API

Subdomain Finder (Certificate Transparency)

webdatatools/subdomain-finder

Subdomain Finder enumerates every subdomain of a domain from Certificate Transparency logs (crt.sh, Cert Spotter) and resolves each one — one row per subdomain, no proxies needed.

Murat Uzun

Subdomain Finder - Certificate Transparency & DNS

antishock/subdomain-finder-certificate-transparency

Enumerate subdomains of any domain from public Certificate Transparency logs and resolve each to IP or CNAME. Returns live status, certificate count, first and last seen dates, issuers and wildcard flag. For attack surface management, authorised recon and vendor discovery. No API key.

Ryan Zinburg

Subdomain Finder: Certificate Transparency

glitchbound/subdomain-scraper

Enumerate every subdomain of a domain from public Certificate Transparency logs. No brute-force wordlist and no DNS hammering, because every TLS certificate is logged, so the hosts are already public record. Deduplicated to one row per hostname, with first seen, issuing CA and current validity.

Daniel Meshulam

Subdomain Finder - Discover Subdomains via CT Logs

logiover/subdomain-finder

Discover every subdomain of any domain using Certificate Transparency logs (crt.sh). Fast bulk subdomain enumeration for security recon, attack-surface mapping, asset discovery and SEO. No API key — export to CSV or JSON.

Logiover

Subdomain Finder & Recon Tool

andok/subdomain-finder

Discover subdomains for any target via passive OSINT sources. Ideal for security bug bounties and attack surface mapping.

Andok

Subdomain Finder - Discover Every Subdomain Of A Domain

thirdwatch/subdomain-finder

Discover every subdomain for any apex domain. Merges 4 sources: certificate transparency (crt.sh), HackerTarget, RapidDNS, plus DNS bruteforcing of common names. Verifies each is live via DNS + HTTP probe.

Thirdwatch

Subdomain Finder - CT Log Enumeration + Live DNS Check

eliai/subdomain-finder

Enumerate a domain's subdomains from Certificate Transparency logs, with an optional live DNS resolve. All subdomains in one record. $0.005 per domain (not per subdomain), far cheaper than paid finders; failures are free.

Broke to Built

Subdomain Intelligence OSINT Scanner & Monitor

thescrapelab/subdomain-intelligence-osint

Subdomain finder and OSINT exposure monitor for authorized domains. Discover subdomains, validate DNS, classify live/auth-gated/DNS-only assets, detect technologies and providers, monitor changes, and generate reports.

Inus Grobler

Domain Attack Surface & Subdomain Scanner

cypherstone/domain-attack-surface-scanner

Find a domain's subdomains from Certificate Transparency logs, resolve each to its IP, and check the live SSL certificate (issuer, expiry, days left). Open-source recon, no API key.

Jeff Ralston

crt.sh Certificate Transparency Scraper

parseforge/crtsh-certificate-transparency-scraper

Search crt.sh certificate transparency logs for a domain and discover subdomains. Get common name, SANs, issuer, validity dates, and serial number per certificate.