# Subdomain Finder & SSL Certificate Transparency Monitor (`northbound-labs/ct-new-certificates-feed`) Actor

Monitor Certificate Transparency logs for new SSL/TLS certificates on your domains. Get new subdomains, issuer and validity dates.

- **URL**: https://apify.com/northbound-labs/ct-new-certificates-feed.md
- **Developed by:** [NorthBound Labs](https://apify.com/northbound-labs) (community)
- **Categories:** Developer tools, Automation
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $2.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Subdomain Finder & SSL Certificate Transparency Monitor

**Find subdomains and monitor new SSL/TLS certificates** issued for your domains, using **Certificate Transparency** logs via the official SSLMate Cert Spotter API. Get each hostname, issuer and validity dates, and get only new certificates on every scheduled run.

- **Official source:** the official SSLMate Cert Spotter API (Certificate Transparency logs).
- **No login, no browser, no personal data.**
- **Monitoring built in:** turn on *Only new since last run* and schedule it for a daily alert feed.
- **Export** to JSON, CSV, Excel, HTML or straight into Google Sheets, Slack, Zapier, Make, n8n or your own code via the Apify API.

### What can you use it for?

- **Security teams:** discover new or unknown subdomains (attack-surface monitoring).
- **Brand protection:** notice certificates issued for your domains you didn't expect.
- **Bug bounty and recon:** enumerate subdomains from CT logs.

### How to use it

1. Click **Try for free** (or **Start**). The input is pre-filled, so the first run works with one click and finishes in seconds.
2. Adjust the filters in the **Input** tab (see the table below).
3. Click **Start** and open the **Output** tab. The *Overview* view shows the key columns; *All fields* shows everything.
4. Download the results (JSON, CSV, Excel...) or connect them to your tools (see *Scheduling and integrations*).

### Input

| Field | Name | What it does |
|---|---|---|
| `domains` | Domains | Root domains to monitor (subdomains included). |
| `daysBack` | Days back | How many days back to look. Default 30. On scheduled runs with 'Only new since last run' on, a small window (1-3 days) is enough. |
| `apiKey` | Cert Spotter API key (optional) | Optional SSLMate API key for higher limits; free unauthenticated tier works for a few domains. |
| `maxItems` | Max results | Stop after this many results. You pay per result ($2 per 1,000), so this caps your cost: 100 results = $0.20. |
| `onlyNew` | Only new since last run | Skip records already returned by earlier runs of this Actor in your Apify account, so each run outputs only new ones. Turn on for scheduled daily alerts; leave off for a one-off full export. |

Example input:

```json
{
  "domains": [
    "example.com"
  ],
  "daysBack": 30,
  "maxItems": 20,
  "onlyNew": true
}
```

### Output

Each result is one record with these fields:

| Field | Description |
|---|---|
| `domain` | Monitored root domain. |
| `dnsName` | Hostname covered by the certificate (often a subdomain). |
| `wildcard` | True for \*.domain certificates. |
| `issuer` | Certificate authority. |
| `notBefore` | Certificate validity start. |
| `notAfter` | Certificate validity end. |
| `certSha256` | Certificate SHA-256 fingerprint. |
| `issuanceId` | Cert Spotter issuance ID. |

Sample result (from a real run, long values shortened):

```json
{
  "domain": "apify.com",
  "dnsName": "status.apify.com",
  "wildcard": false,
  "issuer": "Let's Encrypt",
  "notBefore": "2026-07-16T15:22:39Z",
  "notAfter": "2026-10-14T15:22:38Z",
  "certSha256": "74c50d029d729e8bbf2e7998e4c94245b49254a205ef52f289ff93fa7b10a8ea",
  "issuanceId": "15903704212"
}
```

### Scheduling and integrations

- **Daily alerts:** in Apify Console, open **Schedules**, create a schedule (for example every day at 08:00) for this Actor with `onlyNew: true`. Each run then returns only records that are new since the previous run.
- **Webhooks:** add a webhook on *Run succeeded* to call your own endpoint, Slack or a workflow tool when new data is ready.
- **Zapier, Make, n8n, Google Sheets, Slack, email:** use Apify's ready-made integrations on the Actor's **Integrations** tab to push each run's dataset wherever you work.
- **API:** run it and get results in one call:

```bash
curl -X POST "https://api.apify.com/v2/acts/northbound-labs~ct-new-certificates-feed/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains": ["example.com"], "daysBack": 30, "maxItems": 20, "onlyNew": true}'
```

Or with the Apify Python client: `ApifyClient(token).actor("northbound-labs/ct-new-certificates-feed").call(run_input={...})`.

### Pricing

This Actor uses **pay-per-event** pricing, so you pay only for what you get:

- **$2.00 per 1,000 results** ($0.002 per result).
- An Actor start event of $0.00005 per run at the default 512 MB memory.

| You get | Cost |
|---|---|
| 20 results (the pre-filled test run) | about $0.04 |
| 100 results | about $0.20 |
| 1,000 results | about $2.00 |
| A daily schedule returning ~50 new results a day for 30 days | about $3.00 a month |

Set **Max results** to cap the cost of any run. Apify's free plan includes monthly credit you can use to try it.

### FAQ

**Do I need an API key?**
No for a few domains: Cert Spotter's free unauthenticated tier works. Add your own SSLMate key in **Cert Spotter API key** for higher limits.

**Why does one certificate appear as several results?**
Each hostname on a certificate is one result, so a certificate covering 3 hostnames returns 3 rows.

**Do I need an account on the source site?**
No. The Actor reads public, logged-out data from Certificate Transparency logs through its official interface.

**Does it return personal data?**
No. Output is limited to organisation-level and record-level fields.

**How fresh is the data?**
As fresh as the source: every run queries it live.

**Is it legal to use this data?**
The data comes from an official public source. You are responsible for using it in line with the source's terms and the laws that apply to you.

**Something broken, or a field you need?**
Open an issue on the **Issues** tab. We read every issue and reply as fast as we can.

# Actor input Schema

## `domains` (type: `array`):

Root domains to monitor (subdomains included).

## `daysBack` (type: `integer`):

How many days back to look. Default 30. On scheduled runs with 'Only new since last run' on, a small window (1-3 days) is enough.

## `apiKey` (type: `string`):

Optional SSLMate API key for higher limits; free unauthenticated tier works for a few domains.

## `maxItems` (type: `integer`):

Stop after this many results. You pay per result ($2 per 1,000), so this caps your cost: 100 results = $0.20.

## `onlyNew` (type: `boolean`):

Skip records already returned by earlier runs of this Actor in your Apify account, so each run outputs only new ones. Turn on for scheduled daily alerts; leave off for a one-off full export.

## Actor input object example

```json
{
  "domains": [
    "example.com"
  ],
  "daysBack": 30,
  "maxItems": 20,
  "onlyNew": false
}
```

# Actor output Schema

## `results` (type: `string`):

All records returned by the run (default dataset, overview view).

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "example.com"
    ],
    "daysBack": 30,
    "maxItems": 20
};

// Run the Actor and wait for it to finish
const run = await client.actor("northbound-labs/ct-new-certificates-feed").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "domains": ["example.com"],
    "daysBack": 30,
    "maxItems": 20,
}

# Run the Actor and wait for it to finish
run = client.actor("northbound-labs/ct-new-certificates-feed").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "example.com"
  ],
  "daysBack": 30,
  "maxItems": 20
}' |
apify call northbound-labs/ct-new-certificates-feed --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,northbound-labs/ct-new-certificates-feed"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/DQ09Qic0V8nJQhWQk/builds/swZjS1tdKfnARyzP1/openapi.json