Crt Sh Subdomain Finder

crt.sh Subdomain Finder — Certificate Transparency Subdomain Discovery

Overview

Discover subdomains associated with a domain using publicly available Certificate Transparency (CT) records from crt.sh.

Provide one or more domains, and this actor extracts hostnames found in certificate records, organizes them into individual subdomain entries, and removes duplicate certificate and hostname combinations.

You can optionally exclude expired certificates and control the maximum number of results collected per run.

Features

• Discover subdomains from public Certificate Transparency records.
• Accept multiple domains as input.
• Extract hostnames from certificate records.
• Collect certificate and issuer information.
• Optionally exclude expired certificates.
• Remove duplicate certificate and hostname combinations.
• Set a maximum number of results per run.
• Export results in JSON, CSV, Excel, and other supported formats.

Collection Mode

Subdomains

Collects certificate records for supplied domains and extracts the associated hostnames as structured subdomain entries.

Use Cases

• Attack Surface Mapping: Discover hostnames associated with a domain for authorized security assessments.
• Asset Inventory: Build structured lists of known subdomains for domain management.
• Brand Monitoring: Identify unexpected or unfamiliar hostnames appearing in certificate records.
• Security Research: Review publicly recorded certificate and issuer information.
• Domain Research: Organize discovered subdomains for further investigation.
• Lead Enrichment: Identify publicly visible product, regional, or service-related hostnames associated with a company domain.

Input Parameters

Parameter	Type	Description
mode	String	Collection mode. Use subdomains to discover subdomains.
domains	Array	List of domains to search.
excludeExpired	Boolean	Set to true to skip certificates that have expired.
maxItems	Integer	Maximum number of results to collect.
requestDelaySecs	Number	Delay between requests.

Example Input

{
  "mode": "subdomains",
  "domains": [
    "apify.com"
  ],
  "excludeExpired": false,
  "maxItems": 50,
  "requestDelaySecs": 1
}

What Data Does This Actor Extract?

Field	Description
subdomain	Discovered hostname associated with the supplied domain.
domain	Original domain used for the lookup.
commonName	Certificate common name.
certId	Certificate record identifier.
issuerName	Certificate issuer name.
issuerCaId	Certificate authority identifier.
notBefore	Certificate validity start date.
notAfter	Certificate expiration date.
serialNumber	Certificate serial number.
scraped_at	Date and time the result was collected.

Example Output

{
  "subdomain": "affiliate.apify.com",
  "domain": "apify.com",
  "commonName": "affiliate.apify.com",
  "certId": 29951075522,
  "issuerName": "C=US, O=Let's Encrypt, CN=YR2",
  "issuerCaId": 432477,
  "notBefore": "2026-10-09T21:27:57",
  "notAfter": "2027-01-07T21:27:56",
  "serialNumber": "05c10dfb5a4b5ba72b1a699d9ab483e4752f",
  "scraped_at": "2026-10-26T00:00:00+00:00"
}

Working with Your Dataset

After the run finishes, open the Dataset tab to review your discovered subdomains and certificate details.

You can export the results in formats such as:

• JSON
• CSV
• Excel
• XML
• HTML

Use the exported data to maintain domain inventories, review certificate history, or support authorized security research.

FAQ

Who is this actor for?

It is useful for security researchers, domain administrators, developers, and analysts who need structured subdomain discovery results.

What is Certificate Transparency?

Certificate Transparency is a public system that records issued digital certificates. These records can reveal hostnames included in certificates.

Can I search multiple domains?

Yes. Add multiple domain names to the domains input array.

Does it collect only active subdomains?

No. Certificate records can contain hostnames that are no longer active. Certificate Transparency records do not confirm that a hostname currently resolves or hosts a working website.

What does excludeExpired do?

When enabled, the actor skips certificates whose expiration date has passed. Hostnames found only in expired certificates will not be included.

Can I schedule recurring runs?

Yes. Use Apify Schedules to run the actor automatically at your preferred interval.

What export formats are supported?

You can export the dataset in JSON, CSV, Excel, and other supported formats.

Why might some lookups return incomplete results?

Certificate Transparency services may occasionally be slow or temporarily unavailable. Results also depend on the certificate records available for each domain.

Disclaimer

This Actor is an independent tool and is not affiliated with, endorsed by, sponsored by, or officially associated with crt.sh, Sectigo, or their owners. It collects publicly available certificate information. Users are responsible for ensuring that their use of the collected data complies with applicable laws and relevant terms of use. Only investigate domains and systems you own or are authorized to assess.

Is Web Scraping Legal?

Collecting information that is already public is generally legal. There is no single law that bans all forms of web scraping. The limits are the usual ones: do not break into accounts, do not take private or confidential data, and be careful with personal data and copyrighted works. A site's terms can also restrict how you access it. Facts such as a public name, price, or rating are not the same thing as republishing someone's article or photo.

This actor collects information from public pages. It does not log in and it does not bypass access controls.

For a longer explanation, see Apify's article Is web scraping legal?.