WORLDEYE PRO TOOL

Certificate Transparency Search — Find a Domain's Issued Certificates

Search the public certificate-transparency logs for every certificate issued for a domain — and uncover the subdomains and infrastructure history those certificates reveal.

TARGET — DOMAIN NAME

PREVIEW — WORLDEYE PRO
Open in WorldEye

EXAMPLE RESULT — FORMAT ONLY, NOT A LIVE CHECK

Certificate transparency record for a sample domain

example.com
certificate issued — example issuer CA — current
www.example.com
covered on the same certificate
mail.example.com
certificate issued — earlier validity window
staging.example.com
certificate issued — expired (name existed at issue)
*.example.com
wildcard certificate — exact names beneath it hidden

This is the shape of a real result, shown with example.com, the reserved documentation domain. The live search runs inside WorldEye's RECON board and is included with WorldEye Pro.

What certificate transparency can and can't tell you

  • CT logs only contain certificates that were publicly issued and logged — which is nearly all publicly trusted certificates, but a service using an internal or private CA leaves no trace here.
  • A certificate for a subdomain proves the name existed when the cert was issued. It does not prove the subdomain is still live, what it serves today, or who operates it now.
  • Wildcard certificates deliberately hide the exact subdomains beneath them, so a domain can have more infrastructure than its CT record shows.
  • Everything here is public by design: certificate transparency exists so the whole internet can audit what was issued. Searching it reveals nothing private — it organises what was already published.

Every time a certificate authority issues a TLS certificate for a public website, the certificate is written into certificate-transparency (CT) logs — public, append-only records that anyone can search. The system was built to catch mis-issued certificates, but it has a famous side effect: because certificates name the domains and subdomains they cover, the logs amount to a public history of a domain's infrastructure. A certificate issued for mail, staging, vpn, or a forgotten test subdomain is recorded forever, even if the subdomain itself was never linked anywhere.

WorldEye's Certs search lives in the RECON board's Domain & Web group and queries those logs for a domain you enter. It returns the certificates found — the names each one covers, the issuing authority, and the validity dates — which makes it a practical crt.sh alternative that sits next to the board's other domain tools: subdomains you discover here can go straight into a DNS lookup, an SSL check, or a technology fingerprint without re-typing anything.

Investigators and administrators use the same data in opposite directions. Defensively, your own domain's CT record shows you the subdomains your organisation has ever certified — including the staging server someone set up in 2022 and never retired. Offensively-minded researchers use it to map a target's footprint, which is precisely why the logs are public: if a name is in a certificate, assume the whole internet can find it, and plan your naming accordingly.

How it works

  1. 1Open the RECON board on the WorldEye globe and choose Certs in the Domain & Web group.
  2. 2Enter a domain name — your own, or one you are researching.
  3. 3Run the search. WorldEye queries the public certificate-transparency logs for certificates covering that domain.
  4. 4Read the record: each certificate's covered names, issuer, and validity window, including subdomains you may not have seen listed anywhere else.
  5. 5Follow up on interesting names in the same board — resolve them with DNS Lookup, check a live certificate with the SSL Checker, or fingerprint what serves them with Tech Detect.

Run Certs in WorldEye

Certs runs live in WorldEye's RECON board — RECON board → Domain & Web → Certs — and is included with WorldEye Pro. Create a free account to explore the board and its free tools, and upgrade when you need the Pro modules.

Open the globeCreate a free accountSee WorldEye Pro

Certificate transparency questions

What is certificate transparency?+
Certificate transparency is a public logging system for TLS certificates. When a trusted certificate authority issues a certificate, it records it in append-only public logs that browsers and researchers can audit. The goal is accountability — a certificate issued for a domain without the owner's knowledge becomes visible. A side effect is that the logs form a searchable history of the names certificates were issued for.
How does this compare to crt.sh?+
crt.sh is the best-known public interface to the same CT logs, and WorldEye's Certs search queries the same underlying public record. The difference is workflow: results here sit inside the RECON board, so a subdomain you find can be carried straight into DNS, SSL, subdomain, and technology checks on the same target instead of living in a separate tab.
Can a certificate search reveal hidden subdomains?+
It can reveal subdomains that were never linked publicly but did receive certificates — staging, VPN, mail, and test names are classic finds. It cannot reveal subdomains that never had a public certificate, names hidden under a wildcard certificate, or anything served under an internal certificate authority. It is a powerful source, not a complete inventory.
I found a certificate for a subdomain I don't recognise. Should I worry?+
Treat it as a prompt to check, not a panic. Look at the issuer and dates: a certificate your own team requested for a project you forgot is common, and an expired certificate for a retired service is usually housekeeping. What deserves real attention is a recent certificate from an issuer your organisation never uses — that can indicate a mis-issuance or a domain-validated certificate someone else obtained, and your CA and DNS records are the next stops.
Does searching CT logs notify the domain owner?+
No. The logs are public records designed to be read by anyone; querying them sends nothing to the domain owner and leaves no trace in their systems. You are reading a published ledger, not touching their servers — the check does not connect to the domain itself at all.
What does it cost?+
Certs is a Pro module in WorldEye's RECON board, included with WorldEye Pro. The board's free tools — the SSL Checker, DNS and WHOIS lookups and others on the Tools page — run with no account at all.

Keep exploring

SSL Checker — inspect a site's live certificate (free)Subdomain Finder — enumerate a domain's subdomainsDNS Lookup — records for any domain (free)All WorldEye tools

One email when the sky does something big

Rocket launches, storms overhead and new camera drops — plus major WorldEye news. Rare, and no spam, ever.

Instant subscribe — no confirmation email. We check the address as you type it in.

All WorldEye tools Open the live map