crt.sh Certificate Transparency Scraper

crt.sh Certificate Transparency Scraper

Scrape certificate transparency logs from crt.sh for any domain, including subdomains, up to a million certificates per run. Each certificate comes with its issuer, validity dates, and SHA-256 fingerprint. No login or API key. Export to CSV, JSON, Excel, or XML.

crt.sh is the public certificate transparency log search engine run by Comodo CA. It records every SSL/TLS certificate ever issued, which makes it the fastest way to map a domain's attack surface, find forgotten subdomains, and spot suspicious certificates. This Actor queries crt.sh directly and returns one flat row per certificate, so you can audit domains you own or are authorized to assess without writing a single line of code.

Who uses it	What they scrape crt.sh for
Security analysts	Audit certificate issuance for domains they defend and spot anomalies before attackers abuse them.
Penetration testers	Enumerate subdomains and forgotten hosts from certificate transparency logs during authorized engagements.
IT asset managers	Maintain an up-to-date inventory of every certificate and subdomain tied to their organization.
Threat intelligence teams	Monitor certificate logs for newly issued certificates that may indicate phishing or brand impersonation.

What it does

This Actor collects certificates from crt.sh for one or more domains and returns each certificate as a flat row with its issuer, validity dates, and SHA-256 fingerprint.

• 🔍 Wildcard subdomain search: enable includeSubdomains to query %.domain and pull every certificate issued to any subdomain.
• 📋 Batch domain input: paste one domain per line to audit multiple domains in a single run.
• 🔢 Result cap: set maxItems to control how many certificates are returned, from 1 to 1,000,000.
• 📄 Flat output: every certificate is returned as one row, ready for CSV, JSON, Excel, or XML export.

Results export to CSV, JSON, Excel, or XML, or straight from the API.

What you can do with crt.sh data

🛡️ Map your attack surface.

A security analyst runs the Actor on their company domain with includeSubdomains enabled and exports the list of subdomains and certificates to prioritize patching and monitoring.

🔎 Find forgotten subdomains.

A penetration tester feeds a client's domain into the Actor during a scoping call and uses the wildcard results to identify hosts that are not in the client's asset inventory.

📅 Audit certificate renewals.

An IT asset manager runs the Actor monthly on all owned domains and filters the output by validity dates to catch certificates that are about to expire.

🚨 Detect suspicious certificates.

A threat intelligence analyst monitors certificate logs for a brand name and reviews newly issued certificates for issuer anomalies that may indicate phishing infrastructure.

Why choose this scraper

	What you get
No API key	crt.sh has no official API key requirement, and this Actor needs none either.
Subdomain discovery	Wildcard mode reveals subdomains that are not linked anywhere else.
Audit-ready	Issuer, validity dates, and SHA-256 fingerprint for every certificate.
Scale	Collect up to a million certificates in one run.

How it compares

No other Store actor targets crt.sh the same way, so the honest comparison is with the alternatives teams actually weigh.

	crt.sh Certificate Transparency Scraper	Build it in-house	By hand
Setup	Run it now, zero config	Days of engineering	None, but hours per pull
When crt.sh changes	Maintained for you	You fix it	You re-learn the page
Proxies, retries, anti-bot	Built in	Your problem	Browser only
Output	Fixed JSON schema, CSV/Excel export	Whatever you build	Copy-paste
Cost	Pay per result	Engineering time	Analyst hours

Configure the run

Drive the Actor from a list of domains, optionally expand each to all subdomains with a wildcard, and cap the total certificates returned per run. The Input tab lists every parameter.

A first run with the defaults:

{
 "domains": [
 "github.com"
 ],
 "maxItems": 10
}

A larger pull:

{
 "domains": [
 "github.com"
 ],
 "maxItems": 200
}

Pricing

Pay-per-result: $0.004 per result collected. You pay only for the results written to your dataset.

Results collected	Approximate cost
100 results	$0.40
1,000 results	$4.00
10,000 results	$40.00

New Apify accounts start with $5 in free credit.

Free users

Free-plan runs return up to 10 results as a preview. Upgrade your Apify plan to collect up to 1,000,000 results per run.

Run it

1. Create a free Apify account with $5 in credit.
2. Open the crt.sh Certificate Transparency Scraper.
3. Set your inputs and any filters, then click Start.
4. Export the results as CSV, Excel, JSON, or XML from the Dataset tab.

Run it programmatically through the Apify API (run-sync-get-dataset-items) or the ApifyClient for JavaScript and Python.

Use with AI agents (MCP)

Give an AI agent live access to crt.sh through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:

$claude mcp add --transport http apify "https://mcp.apify.com?tools=parseforge/crtsh-certificate-transparency-scraper"

Then prompt it in plain language to run the scraper and read back the results.

Troubleshooting

Why am I getting no results?

Check that the domain is spelled correctly and that it has certificates in the transparency logs. Some very new or internal-only domains may not have any public certificates. Try a well-known domain like github.com to confirm the Actor is working.

Why does the run take a long time?

Wildcard searches and large maxItems values can take longer because crt.sh has to return many certificates. Reduce maxItems or disable includeSubdomains if you only need the apex domain.

Why did I get fewer results than maxItems?

The Actor stops when it has collected maxItems certificates or when crt.sh has no more matching certificates. If the domain has fewer certificates than your limit, you will get all of them.

Why are some certificates missing fields?

crt.sh occasionally has incomplete records for older or revoked certificates. The Actor returns whatever fields are present in the log, and missing values will be empty in the output.

*Can I search for a wildcard domain like .example.com?

You should enter the base domain (example.com) and enable includeSubdomains. The Actor will automatically query %.example.com, which is the correct wildcard syntax for crt.sh.

FAQ

Question	Answer
What is crt.sh?	crt.sh is a free web service operated by Comodo CA that lets anyone search the public certificate transparency logs. It records every SSL/TLS certificate that has been issued by a publicly trusted certificate authority.
Do I need an API key or login?	No. crt.sh does not require authentication for its search interface, and this Actor uses the same public endpoint. You only need an Apify account to run the Actor.
Can I search for subdomains?	Yes. Enable the includeSubdomains option and the Actor will query %.domain, which returns certificates issued to any subdomain of the domain you entered.
How many certificates can I get?	You can set maxItems to any number from 1 to 1,000,000. The Actor will stop after collecting that many certificates, even if more exist in the logs.
What data does each certificate row include?	Each row includes the certificate's issuer, validity start and end dates, and SHA-256 fingerprint, along with the domain it was issued to. The exact field list is shown in the sample output below.
Can I search multiple domains at once?	Yes. Enter one domain per line in the domains input field. The Actor will query each domain and combine the results into one dataset.
Is this legal to use?	Certificate transparency logs are public by design, and querying them is legal. You should only use the results for domains you own or are authorized to assess.
What formats can I export?	The Actor returns data in Apify's standard dataset format, which you can export to CSV, JSON, Excel, or XML from the Apify console or API.
How fresh is the data?	The Actor queries crt.sh live on every run, so you get the certificates that are in the transparency logs at that moment. There is no caching.
Can I schedule this to run automatically?	Yes. You can set up a schedule in Apify to run the Actor daily, weekly, or on any cron expression, and have the results pushed to a dataset or external storage.

Related actors

Browse the full ParseForge collection for more scrapers.

🆘 Need help? Email parseforge@protonmail.com with your run ID, your input, and what you expected.

⚠️ Disclaimer. This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by Comodo CA Ltd. It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.