🔐 crt.sh Certificate Transparency Scraper

🚀 Map a domain's certificate footprint in one run. A single search of github.com returns 1,060 certificate log entries, each with its common name, subdomains, issuer, and validity window.

Certificate Transparency (CT) logs are public, append-only records of every TLS certificate a Certificate Authority issues. Because a certificate has to name the host it protects, those logs quietly reveal subdomains and internal hostnames that never appear in DNS scans or sitemaps. This actor queries crt.sh, the CT search service operated by Sectigo, and turns the raw log into clean, structured records.

Point it at one or more domains you own or are authorized to test, flip on the wildcard option, and you get back every certificate ever logged for that domain and its subdomains. It is built for defensive security work: attack-surface mapping, asset inventory, and watching your own certificates as they are issued.

🎯 Target Audience	💡 Primary Use Cases
Security engineers and blue teams	Attack-surface and subdomain mapping
IT and infrastructure teams	Asset inventory of your own hostnames
Domain and brand owners	Monitoring certificates issued for your domains
Compliance and audit teams	Checking issuers and validity on your estate
Researchers and analysts	Studying public CT data at scale

📋 What the crt.sh Certificate Transparency Scraper does

The actor searches the crt.sh JSON endpoint for each domain you provide. With the wildcard option enabled it queries %.yourdomain.com, so certificates issued to subdomains are included alongside the apex domain. For every certificate in the log it returns one row containing the crt.sh id, the common name, the full list of Subject Alternative Names (SANs) as an array, the issuing CA, the serial number, and the not before, not after, and log entry timestamps. A direct crt.sh/?id= link is added so you can open any certificate in one click.

crt.sh can be slow and sometimes answers with a 502 while it is under load, so the actor retries each query with a generous timeout and backoff, and falls back from the wildcard form to the plain domain if needed.

📊 Data fields

Each record includes: commonName, crtShUrl, issuerName, notAfter, notBefore, queryDomain, results, sans, scrapedAt, serialNumber. These field names come straight from the actor's dataset schema, so what you see here is what lands in your dataset.

🚀 How to use

1. Sign up for Apify using this link if you do not have an account yet.
2. Open the crt.sh Certificate Transparency Scraper and click Try for free.
3. Enter one or more domains you own or are authorized to assess, then choose whether to include subdomains.
4. Set maxItems to control how many certificates you pull, and click Start.
5. When the run finishes, browse the dataset in the console or pull it from the API for your own tooling.

🔗 Recommended Actors

• UK Postcodes Scraper — look up UK postcodes and administrative areas.
• OpenAQ Air Quality Scraper — pull public air quality measurements.
• Open Charge Map Scraper — collect EV charging station data.
• Libraries.io Scraper — gather open source package metadata.

💡 Pro Tip: browse the complete ParseForge collection.

⚠️ Disclaimer: independent tool, not affiliated with crt.sh or Sectigo. Only publicly available Certificate Transparency data is collected. Use only against domains you own or are authorized to assess.

🆘 Need Help?

If you hit a bug, have questions about setup, or need a scraper we haven't built yet, open our contact form or write to parseforge@protonmail.com. We also take on paid custom data projects.

For faster answers, join our Discord. It's the best place to get support and suggest new actors.