Skip to main content
Search certificate transparency logs for every TLS certificate issued against your domains. Each certificate is a public record of a host that exists, so this is the fastest way to find subdomains, shadow IT, and stale hosts you never registered yourself. This source is synchronous — one call returns the matching certificates in the same response. Send your domain as the query parameter (3–1024 characters). The default field is domain, so a bare domain matches it. To scope by issue date, add a createdAt clause with the AND, OR, and NOT operators. Because the query syntax uses :, let curl -G --data-urlencode handle the encoding.
The full endpoint reference is certificate_database_search. This source costs 0 credits per call and is throttled at 10,000 requests per day.

​
Request parameters

​
What comes back

The response is a paginated envelope. The certificates are in content; the surrounding fields describe the page you are on. Page envelope fields:
  • content — array of certificate records (see below).
  • hasContent — true when this page holds at least one certificate.
  • number — current page index (zero-based).
  • size — page size used for this request.
  • totalElements — total certificates matching the query.
  • totalPages — total pages available.
  • numberOfElements — count of certificates on this page.
  • first / last — booleans flagging the first and last page.
  • follow_up_token — token that replays this exact search later.
Each item in content is one certificate:
  • id — the certificate’s record ID.
  • createdAt — when the record was indexed (YYYY-MM-DD HH:MM:SS).
  • domain — the domain or host the certificate was issued for.
  • notBefore — start of the certificate’s validity window (YYYY-MM-DD HH:MM:SS).
  • notAfter — end of the validity window (YYYY-MM-DD HH:MM:SS).
  • algorithm — the signature algorithm.
  • fingerprint — the certificate fingerprint.
  • serialNumber — the certificate serial number.
  • issuer — the certificate authority that signed it.
  • cvssScore — risk score attached to the record, when present.
Match each domain against your asset inventory. Anything you do not recognize — a vpn-test host, a forgotten staging subdomain, a certificate from an unexpected issuer — is a lead to investigate, and a notAfter date in the past flags a stale host that may still be reachable.