CRT.sh Certificate Transparency Lookup
Query Certificate Transparency logs to discover subdomains and domains from SSL/TLS certificate records. Passive recon — no direct requests to the target.
What is Certificate Transparency?
Certificate Transparency (CT) is a public logging system that records all SSL/TLS certificates issued by Certificate Authorities. Security researchers use CT logs (via crt.sh) to discover subdomains and domains without actively scanning the target. This passive recon technique is one of the most effective ways to map an organization's attack surface. Every certificate issued for a domain is publicly recorded, including wildcard certificates that reveal additional subdomains.