Pricing

from $2.00 / 1,000 hosts

Try for free

Go to Apify Store

crt.sh Subdomain Finder - Certificate Search

Try for free

Find every subdomain of a domain from public Certificate Transparency logs (crt.sh), one row per host: days until certificate expiry, issuer, environment inferred from the name (staging, dev, production) and first-seen date. Asset inventory, no API key.

Pricing

from $2.00 / 1,000 hosts

Rating

0.0

(0)

Developer

Tom Awake

Actor stats

Bookmarked

Total users

Monthly active users

20 hours ago

Last modified

Categories

Developer tools

SEO tools

MCP servers

Domains

domains

Required

One or more domains, for example shopify.com. Subdomains are included automatically, so there is no need to list them. URLs and leading wildcards are accepted and cleaned up. Up to 50 domains per run.

Type:array

Min. items:1

Max. items:50

Output shape

mode

Optional

One row per host is the inventory: every certificate for a host is merged into a single line with its expiry, issuer and history. One row per certificate keeps each certificate separate, for audit trails and issuance timelines.

Type:string

Default:hosts

Options:

hostscertificates

Currently valid certificates only

activeOnly

Optional

On by default, and faster: one query instead of two. Turning it off adds the historical record, which on shopify.com raises the inventory from 469 hosts to 627 — including hosts whose certificates have lapsed, often the most interesting ones.

Type:boolean

Default:true

Expiring within (days)

expiringWithinDays

Optional

Keep only hosts expiring within this many days. 30 is the usual renewal window. Leave empty to keep everything.

Type:integer

Minimum:0

Maximum:3650

Environments

environments

Optional

Filter by the environment inferred from the hostname. Leave empty for all. Staging, Development and Internal together are the shadow estate: 170 of 627 hosts on shopify.com.

Type:string[]

Include wildcard certificates

includeWildcards

Optional

Wildcard entries such as *.example.com are real inventory but cover an unknown number of hosts. 5% of rows on shopify.com.

Type:boolean

Default:true

Include names outside the searched domain

includeRelatedDomains

Optional

A certificate often covers several unrelated domains at once. Turning this on keeps those names, which is how sister brands and shared hosting providers surface. Off by default, because it widens the result beyond what you asked for.

Type:boolean

Default:false

Maximum rows

maxItems

Optional

If the inventory is larger, rows closest to expiry are kept first, so truncation never removes what you were looking for.

Type:integer

Minimum:1

Maximum:50000

Default:1000

Subdomain Finder (Certificate Transparency)

webdatatools/subdomain-finder

Subdomain Finder enumerates every subdomain of a domain from Certificate Transparency logs (crt.sh, Cert Spotter) and resolves each one — one row per subdomain, no proxies needed.

Murat Uzun

Subdomain Finder - Certificate Transparency & DNS

antishock/subdomain-finder-certificate-transparency

Enumerate subdomains of any domain from public Certificate Transparency logs and resolve each to IP or CNAME. Returns live status, certificate count, first and last seen dates, issuers and wildcard flag. For attack surface management, authorised recon and vendor discovery. No API key.

Ryan Zinburg

Subdomain Finder: Certificate Transparency

glitchbound/subdomain-scraper

Enumerate every subdomain of a domain from public Certificate Transparency logs. No brute-force wordlist and no DNS hammering, because every TLS certificate is logged, so the hosts are already public record. Deduplicated to one row per hostname, with first seen, issuing CA and current validity.

Daniel Meshulam

Subdomain Finder - Discover Subdomains via CT Logs

logiover/subdomain-finder

Discover every subdomain of any domain using Certificate Transparency logs (crt.sh). Fast bulk subdomain enumeration for security recon, attack-surface mapping, asset discovery and SEO. No API key — export to CSV or JSON.

Logiover

Subdomain Finder & Recon Tool

andok/subdomain-finder

Discover subdomains for any target via passive OSINT sources. Ideal for security bug bounties and attack surface mapping.

Andok

Subdomain Finder - Discover Every Subdomain Of A Domain

thirdwatch/subdomain-finder

Discover every subdomain for any apex domain. Merges 4 sources: certificate transparency (crt.sh), HackerTarget, RapidDNS, plus DNS bruteforcing of common names. Verifies each is live via DNS + HTTP probe.

Thirdwatch

Subdomain Finder - CT Log Enumeration + Live DNS Check

eliai/subdomain-finder

Enumerate a domain's subdomains from Certificate Transparency logs, with an optional live DNS resolve. All subdomains in one record. $0.005 per domain (not per subdomain), far cheaper than paid finders; failures are free.

Broke to Built

Subdomain Intelligence OSINT Scanner & Monitor

thescrapelab/subdomain-intelligence-osint

Subdomain finder and OSINT exposure monitor for authorized domains. Discover subdomains, validate DNS, classify live/auth-gated/DNS-only assets, detect technologies and providers, monitor changes, and generate reports.

Inus Grobler

Domain Attack Surface & Subdomain Scanner

cypherstone/domain-attack-surface-scanner

Find a domain's subdomains from Certificate Transparency logs, resolve each to its IP, and check the live SSL certificate (issuer, expiry, days left). Open-source recon, no API key.

Jeff Ralston

crt.sh Certificate Transparency Scraper

parseforge/crtsh-certificate-transparency-scraper

Search crt.sh certificate transparency logs for a domain and discover subdomains. Get common name, SANs, issuer, validity dates, and serial number per certificate.