Subdomain Finder & SSL Certificate Transparency Monitor

Find subdomains and monitor new SSL/TLS certificates issued for your domains, using Certificate Transparency logs via the official SSLMate Cert Spotter API. Get each hostname, issuer and validity dates, and get only new certificates on every scheduled run.

• Official source: the official SSLMate Cert Spotter API (Certificate Transparency logs).
• No login, no browser, no personal data.
• Monitoring built in: turn on Only new since last run and schedule it for a daily alert feed.
• Export to JSON, CSV, Excel, HTML or straight into Google Sheets, Slack, Zapier, Make, n8n or your own code via the Apify API.

What can you use it for?

• Security teams: discover new or unknown subdomains (attack-surface monitoring).
• Brand protection: notice certificates issued for your domains you didn't expect.
• Bug bounty and recon: enumerate subdomains from CT logs.

How to use it

1. Click Try for free (or Start). The input is pre-filled, so the first run works with one click and finishes in seconds.
2. Adjust the filters in the Input tab (see the table below).
3. Click Start and open the Output tab. The Overview view shows the key columns; All fields shows everything.
4. Download the results (JSON, CSV, Excel...) or connect them to your tools (see Scheduling and integrations).

Input

Field	Name	What it does
domains	Domains	Root domains to monitor (subdomains included).
daysBack	Days back	How many days back to look. Default 30. On scheduled runs with 'Only new since last run' on, a small window (1-3 days) is enough.
apiKey	Cert Spotter API key (optional)	Optional SSLMate API key for higher limits; free unauthenticated tier works for a few domains.
maxItems	Max results	Stop after this many results. You pay per result ($2 per 1,000), so this caps your cost: 100 results = $0.20.
onlyNew	Only new since last run	Skip records already returned by earlier runs of this Actor in your Apify account, so each run outputs only new ones. Turn on for scheduled daily alerts; leave off for a one-off full export.

Example input:

{
  "domains": [
    "example.com"
  ],
  "daysBack": 30,
  "maxItems": 20,
  "onlyNew": true
}

Output

Each result is one record with these fields:

Field	Description
domain	Monitored root domain.
dnsName	Hostname covered by the certificate (often a subdomain).
wildcard	True for *.domain certificates.
issuer	Certificate authority.
notBefore	Certificate validity start.
notAfter	Certificate validity end.
certSha256	Certificate SHA-256 fingerprint.
issuanceId	Cert Spotter issuance ID.

Sample result (from a real run, long values shortened):

{
  "domain": "apify.com",
  "dnsName": "status.apify.com",
  "wildcard": false,
  "issuer": "Let's Encrypt",
  "notBefore": "2026-07-16T15:22:39Z",
  "notAfter": "2026-10-14T15:22:38Z",
  "certSha256": "74c50d029d729e8bbf2e7998e4c94245b49254a205ef52f289ff93fa7b10a8ea",
  "issuanceId": "15903704212"
}

Scheduling and integrations

• Daily alerts: in Apify Console, open Schedules, create a schedule (for example every day at 08:00) for this Actor with onlyNew: true. Each run then returns only records that are new since the previous run.
• Webhooks: add a webhook on Run succeeded to call your own endpoint, Slack or a workflow tool when new data is ready.
• Zapier, Make, n8n, Google Sheets, Slack, email: use Apify's ready-made integrations on the Actor's Integrations tab to push each run's dataset wherever you work.
• API: run it and get results in one call:

curl -X POST "https://api.apify.com/v2/acts/northbound-labs~ct-new-certificates-feed/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains": ["example.com"], "daysBack": 30, "maxItems": 20, "onlyNew": true}'

Or with the Apify Python client: ApifyClient(token).actor("northbound-labs/ct-new-certificates-feed").call(run_input={...}).

Pricing

This Actor uses pay-per-event pricing, so you pay only for what you get:

• $2.00 per 1,000 results ($0.002 per result).
• An Actor start event of $0.00005 per run at the default 512 MB memory.

You get	Cost
20 results (the pre-filled test run)	about $0.04
100 results	about $0.20
1,000 results	about $2.00
A daily schedule returning ~50 new results a day for 30 days	about $3.00 a month

Set Max results to cap the cost of any run. Apify's free plan includes monthly credit you can use to try it.

FAQ

Do I need an API key? No for a few domains: Cert Spotter's free unauthenticated tier works. Add your own SSLMate key in Cert Spotter API key for higher limits.

Why does one certificate appear as several results? Each hostname on a certificate is one result, so a certificate covering 3 hostnames returns 3 rows.

Do I need an account on the source site? No. The Actor reads public, logged-out data from Certificate Transparency logs through its official interface.

Does it return personal data? No. Output is limited to organisation-level and record-level fields.

How fresh is the data? As fresh as the source: every run queries it live.

Is it legal to use this data? The data comes from an official public source. You are responsible for using it in line with the source's terms and the laws that apply to you.

Something broken, or a field you need? Open an issue on the Issues tab. We read every issue and reply as fast as we can.