SSL Certificate Subdomain Finder: List Subdomains from Certificate Transparency Logs

Find the subdomains of any domain by reading the public Certificate Transparency (CT) logs. Every time a certificate authority issues an SSL/TLS certificate, the hostnames on it are written to public logs. This actor searches those logs for the domains you list and returns one row per hostname, with the date it first appeared, when its newest certificate expires, who issued it, and how many certificates it has had.

It reads only public records. It never contacts the domains you look up, so there is nothing to scan, no login, and no proxy.

What does this Actor do?

For each domain you enter, the actor asks the public crt.sh search for every certificate that names that domain or any subdomain of it. If crt.sh does not answer, it falls back to the Cert Spotter public API. It then merges all certificates into one record per hostname and adds a few computed fields:

• firstSeenAt: the issue date of the oldest certificate that names the host.
• lastSeenAt: the issue date of the newest one.
• expiresAt and status: active, expiring_soon (30 days or less) or expired.
• newScore: a 0 to 100 freshness score. Recently appearing hostnames score high.
• certCount, issuers, depth, and a link to the newest certificate on crt.sh.

Run in 30 seconds

1. Open the Actor and press Try for free (a free Apify account is enough).
2. Keep the two prefilled domains and press Start. A run takes about a minute.
3. Open the Output tab. Use the table view or download CSV, Excel or JSON.

Input

Field	What it does
domains	List of domains, for example example.com. A full URL also works.
hostnameContains	Keep hostnames containing one of these words, for example staging, dev, vpn.
newWithinDays	Keep hostnames first seen in the last N days. 0 means no limit.
statusFilter	all (default), active, or expiring_soon.
includeExpired	Turn off to read only certificates that are still valid.
maxItems	Stop after this many hostnames.

Sample input:

{
  "domains": ["apify.com", "anthropic.com"],
  "hostnameContains": ["api", "dev", "staging"],
  "newWithinDays": 90,
  "maxItems": 100
}

Output

One row per hostname:

Field	Meaning
subdomain, rootDomain	The hostname and the domain you searched.
depth	Number of labels in front of the root domain. 0 is the root itself.
status	active, expiring_soon, expired or unknown.
newScore	Freshness score from 0 to 100.
firstSeenAt, lastSeenAt	ISO dates of the oldest and newest certificate issue.
expiresAt, daysToExpiry	Newest expiry date and days left (negative if expired).
daysSinceFirstSeen	Whole days since the first certificate.
certCount, issuers	How many certificates name the host, and which authorities issued them.
coveredByWildcard	True if a wildcard certificate such as *.example.com also covers it.
certUrl, sourceUrl, latestCertId	Links to evidence on crt.sh.
source, checkedAt	Which service answered, and when.

Sample output

{
  "subdomain": "staging.example.com",
  "rootDomain": "example.com",
  "depth": 1,
  "status": "active",
  "newScore": 79,
  "firstSeenAt": "2026-10-12T08:14:03.000Z",
  "lastSeenAt": "2026-10-12T08:14:03.000Z",
  "expiresAt": "2027-01-10T08:14:02.000Z",
  "daysSinceFirstSeen": 9,
  "certCount": 1,
  "issuers": ["Let's Encrypt"],
  "certUrl": "https://crt.sh/?id=123456789",
  "source": "crt.sh"
}

Use cases

• Map the public footprint of your own company and spot forgotten hosts such as old staging or test sites before an attacker does.
• Run it weekly with newWithinDays set to 7 and send new hostnames to Slack, a ticket queue or an n8n workflow.
• Prepare a pen test or bug bounty scope from public data, with the evidence link on every row.
• Watch a competitor or an acquisition target for new product subdomains.
• Check certificate expiry across a list of domains with statusFilter set to expiring_soon.

Why use it

• Public data only. CT logs are open by design. No login, no cookies, no proxy.
• Nothing touches the target. The actor never connects to the domains you look up.
• Evidence on every row. Each hostname links to its certificate on crt.sh.
• Backup source. If crt.sh is busy, the run falls back to Cert Spotter instead of failing.

Pricing

Pay per event. You pay a small fixed amount per hostname delivered, listed on the Pricing tab, plus a tiny start fee per run. Hostnames removed by your filters are never charged, and you can set a maximum cost per run in the run options.

FAQ

Does this find every subdomain? No. It finds hostnames that appeared on a publicly logged certificate. A host that only uses plain HTTP, a private certificate authority, or a wildcard certificate will not show up by name.

Why is a hostname listed that no longer exists? Certificates stay in the logs forever. Use status and daysToExpiry to tell old records from live ones. A valid certificate does not prove the host still answers.

Is this a scanner? No. It only reads public records. It sends no traffic to the domains you enter.

Why does a large domain take longer? Big companies have tens of thousands of certificates. crt.sh can take up to a minute for them. Use newWithinDays or hostnameContains to narrow the output.

Limits

• The data is only as complete as the public CT logs and the crt.sh index.
• crt.sh is a free shared service and can be slow or return errors. The actor retries and then falls back to Cert Spotter, whose free quota is small.
• One domain is read at a time to stay polite to the service.
• This is not security advice. Confirm findings before acting on them.

Related Actors

• Domain Intelligence Lookup adds registration and DNS details for a domain.
• Technical SEO Page Audit audits the pages on a site.
• Sitemap Link Inventory lists the URLs a site publishes in its sitemap.

Found a bug or need a field? Open an issue on the Issues tab with the run URL.

More from DWA Open Data

Browse all 69 data Actors, with live prices and sample output, at open-data-actors.pages.dev.

---

Feedback: if this Actor was useful, or if it fell short, an honest review on the Reviews tab helps other users decide. Problems or feature requests: please open an Issue and we usually reply within one business day.