crt.sh Certificate Monitor - New TLS Certs

Watch hostnames you already own or operate for newly logged public certificates on crt.sh. Get newest-cert facts and expiry buckets — without connecting to the target host.

This Actor takes a caller-owned list of public DNS hostnames, queries crt.sh JSON, and writes one structured row per host: newest not-before / not-after, issuer, serial, common name, certificate count and an expiry bucket. Pass the previous run's snapshot back in and you get INITIAL, UNCHANGED or CHANGED when a newer cert appears.

It never fetches https://your-host. Certificate Transparency data only.

---

What this Actor does

You already know the hostnames (your product domains, a brand-protection list, a takeover watchlist). You want a scheduled check for a newly logged certificate or an expiry window — without a live TLS handshake and without dumping the entire CT universe.

That is the job: a hostname watchlist on crt.sh, not a handshake auditor and not a CT firehose.

---

What you get

{
  "schemaVersion": 1,
  "id": "example.com",
  "status": "ok",
  "domain": "example.com",
  "newestNotBefore": "2026-07-29T22:10:08",
  "newestNotAfter": "2026-09-20T22:10:07",
  "newestIssuer": "Example CA",
  "newestSerial": "abc",
  "newestCommonName": "example.com",
  "certificateCount": 2,
  "expiryBucket": "DUE_SOON",
  "daysUntilExpiry": 14,
  "changeType": "INITIAL",
  "changedFields": [],
  "checkedAt": "2026-09-06T12:00:00.000Z",
  "sourceUrl": "https://crt.sh/?Identity=example.com&output=json",
  "error": null
}

example.com is a public example hostname. Field values above are illustrative of shape. The Actor tries Identity= then q= because crt.sh sometimes answers one form and 404s the other.

expiryBucket is OVERDUE, DUE_SOON (within expiryWarningDays), LATER, or UNKNOWN.

---

Main use cases

• New-cert alerts. See when a newer public certificate is logged for a host you watch.
• Expiry buckets. Route DUE_SOON / OVERDUE without SSHing to the box.
• Brand / shadow-IT. Watch product domains for unexpected newly logged names.
• Pair with a handshake audit. Use the SSL Actor (below) when you need the live cert, not CT.

---

Quick start

{
  "domains": ["example.com"],
  "maxItems": 1,
  "expiryWarningDays": 30
}

Run it, open the dataset, and save NEXT_SNAPSHOT from the default key-value store.

---

Repeat workflow

1. Keep one hostname watchlist per customer or environment (1–20 hosts).
2. Start a bounded run. Schedule it yourself if you need a cadence.
3. Save NEXT_SNAPSHOT in your private workflow state.
4. On the next run pass it as previousSnapshot and set onlyChanges: true.
5. Route CHANGED rows (new serial, new not-before, bucket moves) for review.

---

Input

Field	Type	Default	What it does
domains	array	—	1–20 public DNS hostnames. IP addresses, localhost and internal suffixes are rejected.
maxItems	integer	20	1–20. Must cover all unique hosts.
expiryWarningDays	integer	30	0–365. Window used for DUE_SOON.
onlyChanges	boolean	false	Suppress unchanged successful records without charging them.
previousSnapshot	object	—	Prior NEXT_SNAPSHOT with kind: "crtsh".

---

Pricing

Event	Price	When it happens
Successful watchlist result	$0.0025	One successful hostname check written to the dataset
Actor start	none	No custom start fee

You are not charged for: crt.sh 404/502/503 after both query forms, parse failures, retries, duplicate hosts, invalid input, or unchanged records suppressed by onlyChanges.

Worked example. 15 hosts daily, 1 new cert/day after the first run → about $0.0025 per day in Actor event charges when onlyChanges is on.

How this compares

Actor	Price per result	Job
This Actor	$0.0025	Caller-owned hostname watchlist on crt.sh
parseforge/crt-sh-scraper (Store card, 2026-09-06)	$0.00333	Dump-oriented CT listing
Owned SSL Certificate Security Audit	live handshake	Different job — connects to the host

---

Using the API

curl --fail -X POST "https://api.apify.com/v2/acts/technicaldost~crtsh-new-certificate-monitor/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"domains":["example.com"],"maxItems":1}'

JavaScript

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const run = await client.actor('technicaldost/crtsh-new-certificate-monitor').call({
    domains: ['example.com'],
    maxItems: 1,
    expiryWarningDays: 30,
});
const { items } = await client.dataset(run.defaultDatasetId).listItems();

Python

from apify_client import ApifyClient
import os

client = ApifyClient(os.environ["APIFY_TOKEN"])
run = client.actor("technicaldost/crtsh-new-certificate-monitor").call(run_input={
    "domains": ["example.com"],
    "maxItems": 1,
})
for row in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(row["domain"], row["newestSerial"], row["expiryBucket"], row["changeType"])

n8n / MCP. Server-side start + poll. Keep APIFY_TOKEN in credentials, not in the workflow JSON you publish.

---

Limitations

• crt.sh is a public volunteer service and is often slow or returns 404/502. The Actor tries two query forms; it does not solve CAPTCHAs or forge tokens.
• Certificate Transparency is not a complete inventory of every certificate on a host (especially privately trusted or never-logged certs).
• This Actor does not connect to the hostname and does not replace a handshake / grade product.
• IP addresses, localhost and internal suffixes are rejected.
• At most 1,000 snapshot records are retained.

Source: public crt.sh JSON. Not affiliated with crt.sh, Sectigo or the CA/Browser Forum.

---

Related Actors

• SSL Certificate Security Audit — live TLS handshake on URLs you supply.
• Hugging Face Model Monitor — SHA/visibility watchlist for Hub models you already use.

---

Changelog

See CHANGELOG.md. Release 1.0.0 (2026-09-06): caller-owned hostname watchlists, Identity+q fallback, expiry buckets, $0.0025 per successful result, no start fee.

Use crt.sh Certificate Monitor with AI agents (MCP)

Give Claude, ChatGPT, Cursor, VS Code or any MCP client this Actor as a tool through the hosted Apify MCP server. The agent sees the input fields with descriptions and example values, runs the Actor, and reads the results.

MCP server URL (this Actor only):

https://mcp.apify.com/?tools=technicaldost/crtsh-new-certificate-monitor

Claude Code:

$claude mcp add --transport http apify "https://mcp.apify.com/?tools=technicaldost/crtsh-new-certificate-monitor" --header "Authorization: Bearer YOUR_APIFY_TOKEN"

Cursor, VS Code, Claude Desktop and other clients (mcp.json or the client's MCP settings):

{
  "mcpServers": {
    "apify": {
      "url": "https://mcp.apify.com/?tools=technicaldost/crtsh-new-certificate-monitor",
      "headers": { "Authorization": "Bearer YOUR_APIFY_TOKEN" }
    }
  }
}

Clients that support sign-in (such as Claude.ai connectors) can use the URL without a token and log in to Apify instead. Get your token in Apify Console → Settings → API & Integrations, or generate a ready config for your client at mcp.apify.com. In the agent the tool is named technicaldost--crtsh-new-certificate-monitor; ask it, for example, to "run crt.sh Certificate Monitor with {"domains": ["example.com"]}".

AI agents without an Apify account can also run and pay for this Actor per request with x402 agentic payments.

Run crt.sh Certificate Monitor via API

Run the Actor and get its results in one call (replace YOUR_APIFY_TOKEN):

curl -X POST "https://api.apify.com/v2/acts/technicaldost~crtsh-new-certificate-monitor/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains": ["example.com"]}'

Python (pip install apify-client):

from apify_client import ApifyClient

client = ApifyClient("YOUR_APIFY_TOKEN")
run = client.actor("technicaldost/crtsh-new-certificate-monitor").call(run_input={"domains": ["example.com"]})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

JavaScript / TypeScript (npm install apify-client):

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: 'YOUR_APIFY_TOKEN' });
const run = await client.actor('technicaldost/crtsh-new-certificate-monitor').call({"domains": ["example.com"]});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

Long runs: start them with POST /v2/acts/technicaldost~crtsh-new-certificate-monitor/runs and fetch the dataset when the run finishes, or receive a webhook.

FAQ

Can I use crt.sh Certificate Monitor with AI agents like Claude or ChatGPT?

Yes. Connect the Apify MCP server with ?tools=technicaldost/crtsh-new-certificate-monitor (see above) and the agent can run the Actor and read its results on its own.

Can I call crt.sh Certificate Monitor from my own code?

Yes. Use the REST API, or the official Python and JavaScript clients shown above. Results are available as JSON, CSV, Excel, XML or HTML.

How do I run it on a schedule?

Save your input as a task in Apify Console and add a schedule (for example, daily). Use webhooks or integrations to send each run's results onward.

Is it legal to use this Actor?

It works with publicly available data. Make sure your use complies with the source website's terms and with data protection laws such as GDPR, especially for personal data.

Something doesn't work or I need a feature. What should I do?

Open an issue in the Issues tab on this Actor's page with an example input, and we'll look into it.