Certificate Transparency Monitor — CT Log & Subdomain Recon API for AI Agents (crt.sh, No API Key)

Keyless certificate-transparency intelligence for security, recon and asset-discovery. Pull TLS certificates from CT logs (crt.sh) for any domain: track newly-issued certs daily, discover subdomains via wildcard, or batch many domains at once. Every certificate becomes one structured row with issuer, validity window, SAN hostnames and serial — ideal for detecting new infrastructure, brand impersonation and attack-surface changes. No API key, no headless browser — pure HTTP + JSON from crt.sh.

Built for the new wave of AI agents that reason about external infrastructure and attack surface — recon agents that watch a target's new certificates, brand-protection agents that detect lookalike domains, asset-discovery agents that enumerate subdomains via CT logs, and RAG pipelines that ground LLM answers in current infrastructure data instead of stale scans.

🏆 Why this Certificate Transparency Monitor?

13 fields per certificate · hundreds to thousands of certs per run · 4 modes (watch / subdomains / domain / bulk) · SAN hostname extraction for subdomain discovery · direct HTTP + JSON (no browser) · retry/backoff on slow crt.sh · export to JSON / CSV / Excel. The unofficial crt.sh API layer for CT-log monitoring, subdomain enumeration and AI-agent infra grounding — pay per saved certificate, empty runs are free.

---

✨ What this Actor does / Key features

• 📜 crt.sh CT-log search — queries https://crt.sh/?q=…&output=json covering all major CT logs (Google Argon, Cloudflare Nimbus, Let's Encrypt Oak, DigiCert, …).
• 👁️ Watch mode (daily monitoring) — daysBack keeps only certs logged in the last N days (by entryTimestamp). 1 = today's new certs; big orgs log dozens/day.
• 🌐 Subdomain discovery — a wildcard %.domain query surfaces every hostname ever certified for a domain, via SAN (nameValues) — often hundreds to thousands for large orgs.
• 🏷️ Rich per-cert fields — commonName, SAN hostnames (nameValues), issuerName, serialNumber, validity window (notBefore / notAfter), and the log entry timestamp.
• 🧹 Filters — excludeExpired drops past-validity certs for a current attack-surface view; dedupBySerial collapses precertificate + final-cert duplicates.
• 📚 Batch domains — domain / bulk mode loops many domains, each tagged with query / domain, to build a full CT-log corpus.
• 🤖 AI-agent friendly — predictable fields, ISO dates, nullable values. Drop straight into a prompt or a vector store.
• 🌐 Proxy-aware & resilient — Apify datacenter proxy for reliability (crt.sh can be slow/overloaded), with a 60s timeout and exponential-backoff retry (up to 5 attempts) on 5xx/timeouts.
• 💰 Pay-per-result — charged per saved certificate, not per run. Empty results are free.

🚀 Quick start (3 steps)

1. Configure — pick a mode and give it a target: a single domain for watch/subdomains, or a domains array for domain/bulk. Set daysBack and maxPerDomain if you want.
2. Run — click Start. The Actor builds the crt.sh query, fetches with retry, normalizes each certificate, and streams one row per cert.
3. Get your data — open the Output tab (Overview or Subdomains view) and export to JSON, CSV, Excel or XML, or read it live via the Apify API / MCP.

📥 Input

Pick a mode, then supply the matching target. Everything else is optional.

Example — daily new certs (schedule this)

{
  "mode": "watch",
  "domain": "google.com",
  "daysBack": 1,
  "maxPerDomain": 500
}

Example — subdomain discovery (wildcard)

{
  "mode": "subdomains",
  "domain": "stripe.com",
  "maxPerDomain": 2000,
  "excludeExpired": true
}

Example — all certs for a list of domains (batch)

{
  "mode": "domain",
  "domains": ["stripe.com", "linear.app", "vercel.com"],
  "maxPerDomain": 1000
}

Field	Type	Default	Description
mode	enum	watch	watch (new certs in N days), subdomains (wildcard discovery), domain (all certs), bulk (many domains). Required.
domain	string	—	Single domain for watch / subdomains.
domains	array	—	Domains for domain / bulk modes.
daysBack	integer	1	Days back for watch mode (1–365). 1 = today.
maxPerDomain	integer	1000	Cap on certs saved per domain (1–20000). Popular domains have tens of thousands.
excludeExpired	boolean	false	Drop certs past their notAfter (current-attack-surface view).
dedupBySerial	boolean	true	Collapse precert + final-cert duplicates by serial.
useApifyProxy	boolean	true	Route through Apify datacenter proxy (helps reliability).

Which mode? Use watch for scheduled daily monitoring, subdomains for a wildcard hostname inventory, domain for a full cert history of a few targets, and bulk to sweep a large watchlist.

📤 Output

Every run streams one certificate per row — 13 fields, exportable to JSON, CSV, Excel or XML. Here is a trimmed sample record:

{
  "query": "stripe.com",
  "domain": "stripe.com",
  "certId": 12345678901,
  "commonName": "*.stripe.com",
  "nameValues": ["stripe.com", "www.stripe.com", "api.stripe.com", "dashboard.stripe.com"],
  "issuerName": "DigiCert TLS RSA SHA256 2020 CA1",
  "serialNumber": "0abc123def456...",
  "notBefore": "2026-06-28T00:00:00.000Z",
  "notAfter": "2027-07-03T23:59:59.000Z",
  "entryTimestamp": "2026-06-28T12:34:56.789Z",
  "loggedDate": "2026-06-28",
  "isExpired": false,
  "scrapedAt": "2026-07-06T12:00:00.000Z"
}

Use the Overview view to scan all certs with issuer + validity, or the Subdomains (SAN) view to read the discovered hostnames per cert.

💡 Use cases

• New-infrastructure detection — run watch daily on a target and alert when a cert is logged for a hostname not seen before — catching new services, staging environments and shadow IT, often before DNS or port scans.
• Subdomain enumeration — run subdomains mode to build a full hostname inventory via CT SANs — passively collected and broader than DNS brute-forcing.
• Brand-protection / lookalike detection — query a brand string to flag impersonation domains (stripe-login.com, secure-stripe.com) the moment they're certified.
• Issuer / CA tracking — track which CAs a target uses and alert on anomalies (e.g. a sudden shift to a cheap CA often used for phishing).
• Attack-surface diffing — schedule weekly domain runs, diff the cert sets, and report new/removed hostnames as attack-surface changes.
• RAG over infrastructure — embed the cert feed into a vector store and answer "when did X hostname first appear?" with citations to the exact cert.
• Threat-intel pipeline — feed new certs into a SIEM and correlate issuer/hostname patterns with known attacker TTPs.

👥 Who uses it

Security & red-team / recon engineers · bug-bounty hunters mapping attack surface · brand-protection & anti-phishing teams · threat-intel analysts · asset-discovery / ASM platforms · AI security-agent builders grounding on live infrastructure data.

💰 Pricing

This Actor runs on a simple pay-per-result model — you pay one event per saved certificate, not per run, and runs that yield zero certs are free. That makes scheduled watch monitoring cheap and predictable. Try it on the free tier first, then scale up. See the Pricing tab on this page for the current rate.

❓ Frequently Asked Questions

Does this Actor need any API keys or a login? No. It queries crt.sh, the public Certificate Transparency log search, which is keyless. No account, no login, no headless browser — just an Apify account.

Is this a crt.sh API alternative? Yes. crt.sh has no clean, structured public API for automation. This Actor wraps its output=json search into a reliable, paginated, retry-hardened layer with normalized fields (SAN split, dedup, filters) — a practical crt.sh / CT-log API alternative for pipelines and AI agents.

Can I run it without an API or a browser? Yes. There's no third-party API key and no headless browser — the Actor pulls certificates over direct HTTP + JSON, which keeps it fast and cheap.

Why crt.sh instead of direct CT-log APIs? crt.sh aggregates all major CT logs (Google, Cloudflare, DigiCert, Let's Encrypt, …) into one searchable interface with deduplication. Querying individual logs means parsing Merkle trees and merge-deduplicating across logs — crt.sh does that for you.

How current is the data? CT logs are append-only and nearly real-time. A cert logged minutes ago appears in crt.sh within minutes to a few hours. watch with daysBack: 1 gives you certs logged in the last 24 hours.

What's in nameValues? The Subject Alternative Names (SAN) of the cert — every hostname the cert is valid for. For a wildcard cert that's *.stripe.com plus explicit names. This is the richest source for subdomain discovery.

Why are some certs duplicated (before dedup)? CT logs record both the precertificate and the final certificate for each issuance, often with the same serial. dedupBySerial: true (default) collapses them into one row.

How much data can I get? maxPerDomain goes up to 20,000 certs per domain, and bulk mode sweeps a whole list. A single subdomains wildcard query on a large org often yields hundreds to thousands of hostnames — hundreds to thousands of rows per run.

How do I export the certificates to CSV or JSON? Run the Actor, then export the dataset as CSV, JSON, Excel or XML from the Apify console, or pull it live through the Apify API / MCP.

Will crt.sh be slow? For popular domains (google, microsoft) with tens of thousands of certs, yes — the query can take 10–60s. The Actor uses a 60s timeout + retry. For most domains it returns in seconds.

Is it legal to use? CT-log data is public by design — required by the CA/Browser Forum Baseline Requirements — and certificate holders consent to logging upon issuance. Respect crt.sh's usage guidelines and use it for security monitoring, asset discovery, brand protection and AI-agent grounding on data that is already public.

Can an AI agent call this directly? Yes — that's the primary design target. Expose it through an MCP server or Apify tool integration; the agent passes a domain + mode and receives structured certs/subdomains back — no crt.sh scraping or SAN parsing on the agent side.

🔗 More recon, website & lead-gen Actors by logiover

Building an attack-surface or recon pipeline? Pair CT-log monitoring with the rest of the website-intelligence suite:

Actor	What it does
Subdomain Finder	Multi-source subdomain enumeration (active + CT)
Bulk DNS Records Lookup	Resolve discovered hostnames (A/AAAA/MX/TXT…)
Bulk WHOIS / RDAP Lookup	Domain ownership & registration for attribution
Bulk SSL Certificate Checker	Live cert inspection (vs CT-log history)
Bulk HTTP Security Headers	Audit security headers across a host list
Bulk URL Status Checker	Liveness & status codes at scale
Website Tech Stack Detector	Fingerprint frameworks & services
Website Change Monitor	Detect content/infrastructure changes
Website Contact Scraper	Emails & contact data from sites
Bulk Social Profile Extractor	Social handles per domain
Bulk Email Verifier	Validate emails for lead-gen
B2B Lead Scraper	Company & contact lead data

👉 Browse all logiover scrapers on Apify Store — 180+ actors across real estate, jobs, crypto, social media & B2B data.

⏰ Scheduling & integration

Schedule this Actor on Apify to run watch daily and catch every new certificate for your targets. Export results to JSON, CSV or Excel, sync to Google Sheets, or push to your SIEM, vector store, BI tools and webhooks through the Apify API. Connect it to Make, n8n or Zapier to build automated recon and brand-monitoring pipelines — or expose it as an MCP tool so a security agent can query CT logs on demand.

⭐ Support & feedback

Found a bug or need an extra field? Open an issue on the Issues tab — response is usually fast. If this Actor saves you time, a ★★★★★ review on the Store page genuinely helps and is hugely appreciated. 🙏

⚖️ Legal

This Actor queries crt.sh, the public Certificate Transparency log search. CT-log data is public by design (required by the CA/Browser Forum Baseline Requirements); certificate holders consent to logging upon issuance. Respect crt.sh's usage guidelines. Use it for legitimate security monitoring, asset discovery, brand protection and AI-agent grounding on data that is already public.

---

📝 Changelog

2026-07-06

• ✨ README overhaul: badge row, green highlights callout, ready-to-run example scenarios, full field reference table, expanded high-intent FAQ (crt.sh API alternative, no key/browser, CSV/JSON export, how much data, legality) and the recon & website-intelligence suite cross-links.

2026-07-02 — v1.0

• Initial release.
• 4 modes: watch, subdomains, domain, bulk.
• crt.sh CT-log search, SAN hostname extraction, issuer/serial/validity fields.
• excludeExpired and dedupBySerial filters.
• daysBack watch window, maxPerDomain cap.
• Apify datacenter proxy default.
• Pay-per-result (result event per saved cert).