Subdomain Finder: Subdomains from Certificate Transparency Logs for Any Domain

$1 per 1,000 subdomains. Platform usage included. No rental, no minimum.

Give it a domain and it lists the subdomains that have appeared in public certificate transparency logs, read through crt.sh. Each subdomain comes with the dates it was first and last seen on a certificate, how many certificates named it, the issuer and when the newest one expires. It is passive: nothing is scanned and your target is never contacted. No account and no API key.

Open it in Apify Console

New to Apify? [Create a free account](https://www.apify.com?fpr=ymnoit) (referral link). Runs from a free plan account return the first 10 results; any paid plan returns everything you ask for, up to your limit.

What it costs

Subdomains	This actor
1,000	$1.00
10,000	$10.00
100,000	$100.00

Plus $0.001 per run. One flat price, platform usage included, so there is no separate compute or proxy bill. Only subdomain rows are charged. A domain that has no certificates in the logs, or a search that fails, returns no row and costs nothing beyond the run fee. A weekly check of 20 domains that finds 2,000 subdomains costs about $2.00 a run.

Why use it

• One flat price. The bill follows the number of subdomains and nothing else.
• Built for a slow source. crt.sh is free but often slow or busy. The actor reads its answer as a stream, caps every attempt in time and size, retries up to twice (asking for valid certificates only when the full query is too heavy), and falls back to a second public source. A run does not hang.
• History, not only today. Old names that no longer resolve are kept, with first and last seen dates, unless you ask for valid certificates only.
• Clean rows. Certificates are counted once even when a log lists both the precertificate and the final one. Email addresses and names outside your domain are dropped.

Quick start

1. Open the actor, type a domain, press Start.
2. Or paste this input:

{ "domains": ["python.org"], "onlyValidNow": false, "maxSubdomainsPerDomain": 200 }

3. Download the results as JSON, CSV or Excel, or read them through the API.

Use it from code

curl -X POST "https://api.apify.com/v2/acts/one_dollar_store~subdomain-finder-crtsh/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains": ["python.org"], "maxSubdomainsPerDomain": 100}'

from apify_client import ApifyClient

client = ApifyClient("YOUR_APIFY_TOKEN")
run = client.actor("one_dollar_store/subdomain-finder-crtsh").call(
    run_input={"domains": ["python.org"], "maxSubdomainsPerDomain": 100}
)
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item["subdomain"], item["lastSeen"], item["currentlyValid"])

Use it from an AI assistant

Claude, ChatGPT, Cursor and other assistants can call this actor through Apify's MCP server. Add it with this server address:

https://mcp.apify.com?tools=one_dollar_store/subdomain-finder-crtsh

Then ask, for example: "List the subdomains of python.org that have a valid certificate today and tell me which ones were first seen this year."

Switching from another subdomain finder

Domains go in domains (a list, so one run can cover many). Limits are maxSubdomainsPerDomain and maxItems. The core output fields are subdomain, domain, firstSeen, lastSeen and currentlyValid. The actor does not resolve names or probe hosts, so there is no IP address field. Use the DNS Records Lookup from the same store for that.

Input

Field	Type	Default	What it does
domains	list of text	required	Domains to search, for example python.org. A subdomain such as docs.python.org finds the names below it.
onlyValidNow	true or false	false	Keep only names whose newest certificate has not expired. Also a lighter search for big domains.
includeWildcards	true or false	false	Adds names such as *.python.org as their own rows, marked isWildcard.
maxSubdomainsPerDomain	number	1000	Most subdomains per domain, in alphabetical order.
maxItems	number	1000	Most rows in the whole run. Minimum 10.

Output fields

Field	Meaning
subdomain	The host name, in lower case.
domain	The domain you searched.
firstSeen, lastSeen	Start date of the oldest and of the newest certificate that names it (UTC).
validUntil, currentlyValid	Expiry of the latest certificate and whether it is still valid today.
certificates	How many different certificates name it.
issuer	Certificate authority of the newest certificate.
isWildcard	true for a wildcard name. Only present with includeWildcards.
latestCertificateUrl	The crt.sh page of the newest certificate. Only for crt.sh results.
source	crt.sh, crt.sh (valid certificates only) or certspotter.

Empty fields are left out of a row. The apex name itself (python.org) is not a subdomain and is not returned.

Sample results

Real rows from a test run on 9 October 2026 for python.org.

[
  {"domain": "python.org", "subdomain": "blog.python.org", "firstSeen": "2026-02-27T21:59:35.000Z", "lastSeen": "2026-08-27T08:12:49.000Z", "validUntil": "2026-11-25T08:12:48.000Z", "currentlyValid": true, "certificates": 4, "issuer": "Let's Encrypt", "latestCertificateUrl": "https://crt.sh/?id=29417390764", "source": "crt.sh"},
  {"domain": "python.org", "subdomain": "docs.python.org", "firstSeen": "2014-09-05T00:00:00.000Z", "lastSeen": "2023-06-29T16:48:43.000Z", "validUntil": "2024-07-30T16:48:42.000Z", "currentlyValid": false, "certificates": 26, "issuer": "GlobalSign nv-sa", "latestCertificateUrl": "https://crt.sh/?id=9781430053", "source": "crt.sh"},
  {"domain": "python.org", "subdomain": "mail.python.org", "firstSeen": "2011-10-10T00:00:00.000Z", "lastSeen": "2026-07-14T06:05:58.000Z", "validUntil": "2026-10-12T06:05:57.000Z", "currentlyValid": true, "certificates": 83, "issuer": "Let's Encrypt", "latestCertificateUrl": "https://crt.sh/?id=27919353165", "source": "crt.sh"},
  {"domain": "python.org", "subdomain": "packaging.python.org", "firstSeen": "2014-09-05T00:00:00.000Z", "lastSeen": "2026-09-26T09:59:26.000Z", "validUntil": "2026-12-25T09:59:25.000Z", "currentlyValid": true, "certificates": 61, "issuer": "Let's Encrypt", "latestCertificateUrl": "https://crt.sh/?id=29619280969", "source": "crt.sh"}
]

Limits

• crt.sh decides how fast and how complete this is. It is free and often slow. The actor tries crt.sh up to three times, each try capped at 70, 50 and 40 seconds, and the last try asks for valid certificates only (source says so). Very large domains often fail on crt.sh; a stream that is cut by the time cap or by a size cap of about 120 MB still returns the rows read so far, and the run summary marks the domain truncated.
• Back up source. If crt.sh gives nothing, the actor asks Certspotter without a key. It lists mostly current certificates and stops after about 4,000 of them, so firstSeen and certificates are thinner and a huge domain is incomplete. source says certspotter. If both sources fail, the domain returns no row and is listed under failedDomains.
• Logs show certificate names, not live hosts. A name can be in a log and no longer exist, and a host can exist without ever having had a public certificate. Use currentlyValid and lastSeen as hints, and check with a DNS lookup.
• Wildcards hide names. A certificate for *.example.com covers every subdomain without listing them. Internal names behind a wildcard will not show up.
• Some names never reach public logs. Certificates from private authorities are not logged.
• Alphabetical cut. When maxSubdomainsPerDomain is lower than the number found, the first names in alphabetical order are returned.

FAQ

How much does it cost to list 10,000 subdomains? $10, plus $0.001 for each run.

Do I pay for compute or proxy on top? No. Platform usage is included in the $1 per 1,000 price.

Does it touch the target domain? No. It reads public certificate transparency logs through crt.sh. Nothing is sent to the domain you search.

Why did a run take a minute or more? crt.sh builds each answer on demand and can be slow for big domains. The actor waits for it, up to the caps above, and then tries again or falls back.

Why is there no IP address? The actor does not resolve names. Feed the list to the DNS Records Lookup if you need A and AAAA records.

Is it legal? Certificate transparency logs are public by design, and the actor only reads them. How you use the results is up to you: follow the terms of crt.sh and Certspotter, and the law where you live. Finding names in logs is not permission to test a system you do not own.

Is this an official crt.sh, Sectigo or Certspotter product? No. It is an independent tool and is not affiliated with or endorsed by any of them.

Do I need an Apify account? Yes. Actors run from an Apify account, and a free account is enough to start: it includes $5 of platform usage every month. You can sign up here. This is a referral link and it costs you nothing.

Is there a limit on the free plan? Yes. A run started from a free plan account delivers the first 10 results, then ends with a message and a link to the plans. Any paid plan returns everything you ask for, up to your own limit. The price per result is the same on every plan.

More from The One Dollar Store

Every actor here costs $1 per 1,000 results, platform usage included. See the whole store: https://apify.com/one_dollar_store

Domains and apps

• Apple App Store Scraper: App details, ratings and search results.
• DNS Records Lookup: DNS records for any list of domains.
• Domain WHOIS Lookup: Registrar, dates and name servers for any domain.
• Shopify App Store Scraper: Shopify apps with ratings and pricing.
• Hugging Face Scraper: Models and datasets with downloads and tags.

Changelog

• October 2026: first release.