crt.sh Certificate Monitor - New TLS Certs

Watch hostnames you already own or operate for newly logged public certificates on crt.sh. Get newest-cert facts and expiry buckets — without connecting to the target host.

This Actor takes a caller-owned list of public DNS hostnames, queries crt.sh JSON, and writes one structured row per host: newest not-before / not-after, issuer, serial, common name, certificate count and an expiry bucket. Pass the previous run's snapshot back in and you get INITIAL, UNCHANGED or CHANGED when a newer cert appears.

It never fetches https://your-host. Certificate Transparency data only.

---

What this Actor does

You already know the hostnames (your product domains, a brand-protection list, a takeover watchlist). You want a scheduled check for a newly logged certificate or an expiry window — without a live TLS handshake and without dumping the entire CT universe.

That is the job: a hostname watchlist on crt.sh, not a handshake auditor and not a CT firehose.

---

What you get

{
  "schemaVersion": 1,
  "id": "example.com",
  "status": "ok",
  "domain": "example.com",
  "newestNotBefore": "2026-07-29T22:10:08",
  "newestNotAfter": "2026-09-20T22:10:07",
  "newestIssuer": "Example CA",
  "newestSerial": "abc",
  "newestCommonName": "example.com",
  "certificateCount": 2,
  "expiryBucket": "DUE_SOON",
  "daysUntilExpiry": 14,
  "changeType": "INITIAL",
  "changedFields": [],
  "checkedAt": "2026-09-06T12:00:00.000Z",
  "sourceUrl": "https://crt.sh/?Identity=example.com&output=json",
  "error": null
}

example.com is a public example hostname. Field values above are illustrative of shape. The Actor tries Identity= then q= because crt.sh sometimes answers one form and 404s the other.

expiryBucket is OVERDUE, DUE_SOON (within expiryWarningDays), LATER, or UNKNOWN.

---

Main use cases

• New-cert alerts. See when a newer public certificate is logged for a host you watch.
• Expiry buckets. Route DUE_SOON / OVERDUE without SSHing to the box.
• Brand / shadow-IT. Watch product domains for unexpected newly logged names.
• Pair with a handshake audit. Use the SSL Actor (below) when you need the live cert, not CT.

---

Quick start

{
  "domains": ["example.com"],
  "maxItems": 1,
  "expiryWarningDays": 30
}

Run it, open the dataset, and save NEXT_SNAPSHOT from the default key-value store.

---

Repeat workflow

1. Keep one hostname watchlist per customer or environment (1–20 hosts).
2. Start a bounded run. Schedule it yourself if you need a cadence.
3. Save NEXT_SNAPSHOT in your private workflow state.
4. On the next run pass it as previousSnapshot and set onlyChanges: true.
5. Route CHANGED rows (new serial, new not-before, bucket moves) for review.

---

Input

Field	Type	Default	What it does
domains	array	—	1–20 public DNS hostnames. IP addresses, localhost and internal suffixes are rejected.
maxItems	integer	20	1–20. Must cover all unique hosts.
expiryWarningDays	integer	30	0–365. Window used for DUE_SOON.
onlyChanges	boolean	false	Suppress unchanged successful records without charging them.
previousSnapshot	object	—	Prior NEXT_SNAPSHOT with kind: "crtsh".

---

Pricing

Event	Price	When it happens
Successful watchlist result	$0.0025	One successful hostname check written to the dataset
Actor start	none	No custom start fee

You are not charged for: crt.sh 404/502/503 after both query forms, parse failures, retries, duplicate hosts, invalid input, or unchanged records suppressed by onlyChanges.

Worked example. 15 hosts daily, 1 new cert/day after the first run → about $0.0025 per day in Actor event charges when onlyChanges is on.

How this compares

Actor	Price per result	Job
This Actor	$0.0025	Caller-owned hostname watchlist on crt.sh
parseforge/crt-sh-scraper (Store card, 2026-09-06)	$0.00333	Dump-oriented CT listing
Owned SSL Certificate Security Audit	live handshake	Different job — connects to the host

---

Using the API

curl --fail -X POST "https://api.apify.com/v2/acts/technicaldost~crtsh-new-certificate-monitor/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"domains":["example.com"],"maxItems":1}'

JavaScript

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const run = await client.actor('technicaldost/crtsh-new-certificate-monitor').call({
    domains: ['example.com'],
    maxItems: 1,
    expiryWarningDays: 30,
});
const { items } = await client.dataset(run.defaultDatasetId).listItems();

Python

from apify_client import ApifyClient
import os

client = ApifyClient(os.environ["APIFY_TOKEN"])
run = client.actor("technicaldost/crtsh-new-certificate-monitor").call(run_input={
    "domains": ["example.com"],
    "maxItems": 1,
})
for row in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(row["domain"], row["newestSerial"], row["expiryBucket"], row["changeType"])

n8n / MCP. Server-side start + poll. Keep APIFY_TOKEN in credentials, not in the workflow JSON you publish.

---

Limitations

• crt.sh is a public volunteer service and is often slow or returns 404/502. The Actor tries two query forms; it does not solve CAPTCHAs or forge tokens.
• Certificate Transparency is not a complete inventory of every certificate on a host (especially privately trusted or never-logged certs).
• This Actor does not connect to the hostname and does not replace a handshake / grade product.
• IP addresses, localhost and internal suffixes are rejected.
• At most 1,000 snapshot records are retained.

Source: public crt.sh JSON. Not affiliated with crt.sh, Sectigo or the CA/Browser Forum.

---

Related Actors

• SSL Certificate Security Audit — live TLS handshake on URLs you supply.
• Hugging Face Model Monitor — SHA/visibility watchlist for Hub models you already use.

---

Changelog

See CHANGELOG.md. Release 1.0.0 (2026-09-06): caller-owned hostname watchlists, Identity+q fallback, expiry buckets, $0.0025 per successful result, no start fee.