Certificate Transparency Search (crt.sh)

Certificate Transparency Search (crt.sh)

Query crt.sh to enumerate all TLS/SSL certificates ever issued for a domain. Certificate transparency logs are public — no API key or account needed.

When to Use

• User wants to find all subdomains of a domain (recon / asset discovery)
• User wants to see what TLS certificates have been issued for their domain
• User is doing OSINT on an organization's infrastructure
• User asks "what subdomains does X have" or "find all certs for domain"
• Security audit: discover forgotten or misconfigured subdomains

How to Use

List all certificates for a domain

$domain = "taracod.com"
$url    = "https://crt.sh/?q=$domain&output=json"

$certs = Invoke-RestMethod -Uri $url
Write-Host "Found $($certs.Count) certificate records"
$certs | Select-Object -First 10 | Format-Table id, name_value, not_before, not_after -AutoSize

Extract unique subdomain names

$domain = "taracod.com"
$url    = "https://crt.sh/?q=$([Uri]::EscapeDataString("*.$domain"))&output=json"

$certs  = Invoke-RestMethod -Uri $url
$names  = $certs | ForEach-Object { $_.name_value -split "`n" } |
          Sort-Object -Unique |
          Where-Object { $_ -ne "" -and $_ -ne "*.$domain" }

Write-Host "Unique subdomains / names ($($names.Count)):"
$names | ForEach-Object { Write-Host "  $_" }