Discuss your project

TOOLBOX · SECURITY CHECK

Track Down Certificates.

Which TLS certificates were issued for your domain? Enter a domain and see what the public certificate transparency logs reveal about issuers, validity and names.

The bot check protects the toolbox against automated abuse.

We query the public certificate data for your domain and its subdomains at crt.sh (Sectigo). We do not open your website or the names found. We do not store results permanently.

WHAT YOU SEE

Every Certificate.
Every Name.

The report shows all certificates valid today for your domain and its subdomains, as they appear in the public logs. There is no grade: only you know whether an issuer or a name is in order.

  • 01

    Issuers

    Which certificate authorities have issued for your domain, and how often? An unknown issuer is the most important sign of a certificate requested by someone else.

  • 02

    Publicly Visible Names

    All host names from the certificates. Names of test systems or remote access are therefore readable for anyone, including attackers.

  • 03

    Expiry

    If even the newest certificate for a name expires in less than 14 days, we point this out: perhaps the automatic renewal is stuck.

  • 04

    Individual Certificates

    The newest ten certificates with issuer, validity and all names, each with a link to the entry on crt.sh. You find all others there through the search.

HOW CERTIFICATE TRANSPARENCY WORKS

Public.
Verifiable.

Certificate transparency is described in the internet standard RFC 9162, version 2.0 after RFC 6962. Our glossary explains the basics of encryption on the web under HTTP.

  • Certificate authorities submit issued certificates to public logs. A log can only be extended; an entry cannot be deleted or changed unnoticed.
  • Browsers such as Google Chrome only trust public TLS certificates if they appear in such logs (Chrome Certificate Transparency Policy).
  • Anyone can search the logs. crt.sh is a free search across them, operated by Sectigo (crt.sh).
  • The downside: anyone who wants to can also find names this way that would otherwise be hard to discover. RFC 9162 says so explicitly (Section 11.5).
  • Certificates are becoming valid for shorter periods: the CA/Browser Forum decided to reduce the maximum validity step by step from 398 to 47 days between March 2026 and March 2029 (Ballot SC-081v3). Automatic renewal thus becomes mandatory.

Sources: RFC 9162, RFC 6962, RFC 8659 (CAA) and Chrome Certificate Transparency Policy.

NOT PART OF THIS CHECK

Certificates in the Log.
Not on the Server.

The check only reads the public logs. Other tools in the toolbox show what your servers actually deliver.

crt.sh is a service of Sectigo. This tool is not an offer from Sectigo and only shows data that is publicly available.

QUESTIONS

Good to Know.

What is certificate transparency?

Certificate transparency (CT) is an open protocol under which certificate authorities write issued TLS certificates into public logs. The logs can only be extended, not changed afterwards. This way anyone can check which certificates exist for a domain and notice certificates issued by others or by mistake. It is described in RFC 9162, the successor of RFC 6962. Browsers such as Google Chrome only trust public certificates if they appear in such logs.

Where does the data come from?

From crt.sh, a free search across the CT logs operated by Sectigo. We query the certificates that are still valid for your domain and all subdomains there. crt.sh is often busy; if the answer takes too long, the query continues in the background, and a second attempt a few minutes later usually shows the result right away.

I do not know an issuer. What now?

Ask your service providers first: hosting, website builders, CDNs or email services often request certificates themselves, under their own name with their certificate authority. If a certificate comes from no one you commissioned, it may have been issued by mistake. Then contact the certificate authority and have it revoked. With a CAA record in DNS, you define which authorities may issue in future.

Why do I see names that are no longer in use?

A certificate is in the log as long as it exists, even if the server behind it was switched off long ago. We only show certificates that are still valid today. So a name appears if a certificate was issued for it in recent months. We deliberately do not check whether the service is still running: we do not open any of the names found.

Which data goes to whom, and does TOMORIS store anything?

Our server asks crt.sh about the domain entered. Sectigo receives the domain name and the address of our server, not your IP address. We keep the answer from crt.sh in memory for up to one hour so that repeated checks do not put load on crt.sh again, and the finished report for five minutes. Nothing is stored permanently.

TOOLBOX

More
Tools.

YOUR NEXT STEP

You Have the Result.
What Comes Next?

We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.

Discuss the Result