What is Certificate Transparency?
Public CT logs record the names (CN and SAN) on certificates a CA issued. This tool queries only the crt.sh JSON API: first q=%.domain, then q=domain if that fails. There is no dictionary or brute-force scan. Each name is not DNS-probed.
The result is names that appeared on a certificate in the past. Expired, never-used, or CDN/anycast names can show up. It is not a live inventory or a pentest.
When crt.sh is slow or down
crt.sh often returns 404 HTML, 502 nginx, or a timeout. The tool surfaces that as a clear error instead of crashing. Try again in a few minutes. There is no Censys or other vendor fallback — crt.sh is the only source.
The response is capped at about 20 seconds and 2 MB. A huge domain is cut at 400 unique names.
Wildcards and scope
*.example.com, example.com, or names that end with .example.com are in scope. Email and IP rows are dropped. Another TLD or a lookalike (example.net) does not appear.
Prefix: type ct:, crt: or crtsh: in the super box to open this page. Use the SSL checker for a live TLS handshake.