Under maintenance

Pricing

from $0.15 / 1,000 certificate records

Try for free

Go to Apify Store

crt.sh Cert Monitor — Subdomain & SSL Cert Discovery

Under maintenance

Try for free

Monitor certificate-transparency logs via crt.sh (keyless, no API key) for any domain: newly issued subdomains, certificate issuers, first/last-seen dates and cert IDs. Flat one-record-per-cert output for CSV/Excel/JSON export. Ideal for attack-surface discovery and brand monitoring.

Pricing

from $0.15 / 1,000 certificate records

Rating

0.0

(0)

Developer

Karl Sundström

Actor stats

Bookmarked

Total users

Monthly active users

2 days ago

Last modified

crt.sh Certificate Transparency Monitor — New Subdomain & SSL Cert Discovery

Independent tool, not affiliated with crt.sh or Sectigo.

Monitor certificate-transparency logs for any domain via crt.sh — keyless, no API key, no login. Extract newly issued subdomains, certificate issuers, validity windows and cert IDs, and get a flat one-record-per-certificate output ready for CSV/Excel/JSON export. New CT-log entries are warm signals: every fresh certificate reveals a hostname that just went live.

Why crt.sh Certificate Transparency Monitor?

🕵️ Attack-surface discovery — catch subdomains the moment certificates appear in public CT logs.
🔔 Change monitoring — run it on a schedule with hoursBack to get only certificates issued since your last check.
🏢 Brand & phishing tracking — watch lookalike domains' certificate activity for security and brand teams.
📋 Flat output — one row per certificate (domain, subdomain, issuer, crtId) built for CRM, sheets and SIEM import.
⚡ No setup — queries crt.sh's open JSON endpoint directly; just enter a domain and run.

Use cases

Attack-surface management · subdomain enumeration · brand/typosquat monitoring · security compliance audits · OSINT research · expired-cert alerting

What data you get

🏷️ Field	Description
🌐 domain	Domain you asked to monitor
🔎 subdomain	Host names covered by the certificate (SAN list)
🏛️ issuer	Certificate-issuing CA (e.g. Let's Encrypt, DigiCert)
📅 notBefore	Certificate validity start
📅 notAfter	Certificate expiry
🕐 entryTimestamp	When the log entry landed in CT logs (if present)
🆔 crtId	crt.sh certificate ID — open `https://crt.sh/?id=<crtId>` for the full cert

How to use

Add the actor to your Apify account and click Run.
Enter one or more domainList entries (e.g. wikipedia.org).
Set hoursBack to filter recent certificates (default 720 h = 30 days; 0 = full history).
Set maxResults to cap the bill (default 100).
Export results as JSON, CSV or Excel, or schedule runs for continuous monitoring.

Input

{
  "domainList": ["wikipedia.org"],
  "hoursBack": 720,
  "maxResults": 100
}

Field	Type	Description	Default
`domainList`	array	Domains to monitor (all subdomains included via `%25.<domain>` CT search)	required
`hoursBack`	integer	Only certificates issued within the last N hours; `0` returns full history	720
`maxResults`	integer	Cap on records per run	100

Output

{
  "domain": "wikipedia.org",
  "subdomain": "*.m.wikipedia.org *.wikipedia.org wikipedia.org",
  "issuer": "C=US, O=Let's Encrypt, CN=YE2",
  "notBefore": "2026-08-05T19:15:41",
  "notAfter": "2026-11-03T19:15:40",
  "entryTimestamp": null,
  "crtId": "28567885787"
}

	Typical subdomain scrapers	This actor
Source	DNS brute-force wordlists	Official certificate-transparency logs
Coverage	Only guessable names	Every hostname that ever got a TLS certificate
API key	Varies	None
Output	Mixed formats	Flat one-row-per-cert, export-ready

Support

Issues and feature requests via the Apify actor page.

SSL Certificate Monitor — Expiry, CT Logs, Subdomain Discovery

gochujang/ssl-certificate-monitor

Monitor SSL certificates for expiry, chain validity, and cipher suites. Discover subdomains via Certificate Transparency logs (crt.sh). Alerts for certificates expiring within N days. No API key required.

Hojun Lee

Certificate Transparency Monitor — AI Agent Recon API

logiover/certificate-transparency-monitor

Keyless certificate transparency intelligence for AI agents: crt.sh CT logs. Track new TLS certs for any domain, discover subdomains via wildcard, batch domains. Issuer, validity, SAN domains and serial per row. No API key, no browser.

Logiover

Subdomain Finder - Discover Subdomains via CT Logs

logiover/subdomain-finder

Discover every subdomain of any domain using Certificate Transparency logs (crt.sh). Fast bulk subdomain enumeration for security recon, attack-surface mapping, asset discovery and SEO. No API key — export to CSV or JSON.

Logiover

Subdomain Enumeration via Certificate Transparency

perryay/subdomain-enumeration-ct-logs

Discover subdomains from Certificate Transparency logs using crt.sh and CertSpotter. Supports multi-source aggregation, deduplication, diff reporting, continuous monitoring, wildcard detection, and batch scanning — ideal for penetration testing, attack surface mapping, and security monitoring.

Perry AY

Attack Surface Intelligence — Certificate Transparency

ryanclinton/crt-sh-search

Turn Certificate Transparency logs into attack-surface intelligence. Find new subdomains, exposed admin/VPN/DevOps services, brand-abuse look-alikes, and infrastructure drift, each with a risk score, recommended action, and investigation priority. Findings and executive summary included.

Ryan Clinton

Subdomain Finder & Recon Tool

andok/subdomain-finder

Discover subdomains for any target via passive OSINT sources. Ideal for security bug bounties and attack surface mapping.

Andok

Domain Attack Surface — SSL + CT Logs + Breach History

gochujang/domain-attack-surface-suite

Complete external security posture for any domain in one run: SSL certificate expiry and chain, subdomain discovery via Certificate Transparency logs (crt.sh), and data breach history from Have I Been Pwned. No API key required for core checks.

Hojun Lee

crt.sh Certificate Transparency Scraper

parseforge/crtsh-certificate-transparency-scraper

Search crt.sh certificate transparency logs for a domain and discover subdomains. Get common name, SANs, issuer, validity dates, and serial number per certificate.

ParseForge

IP Geolocation Lookup — Country, City, ISP & VPN Detection

ryanclinton/ip-geolocation-lookup

Look up geographic location, ISP details, and security flags for any list of IP addresses -- from one to tens of thousands.

Ryan Clinton

CISA Known Exploited Vulnerabilities Search

ryanclinton/cisa-kev-search

Search and filter the official CISA Known Exploited Vulnerabilities (KEV) catalog -- the authoritative U.S. government list of vulnerabilities actively exploited in the wild.

Ryan Clinton