CT Subdomain Enumerator
List the subdomains of a domain that appear in public Certificate Transparency logs, without touching the domain itself.
Looks up live data What you enter is sent to our server to fetch live results from public sources. Results are cached briefly. A Cloudflare Turnstile bot check runs when you press the button (it loads a script from challenges.cloudflare.com and may show a short challenge).
This is a passive lookup of public Certificate Transparency logs through our server. Nothing is sent to the domain you enter, but the name is passed on to crt.sh (or Cert Spotter, if crt.sh is down), which are third-party services. A Cloudflare Turnstile check runs when you press the button.
| Name | First certificate | Last expiry | Certs | Issuer | Hints |
|---|
Certificate logs list names that were put on certificates, not necessarily names that exist now. Use this only on domains you own or are allowed to assess.
Report a problem with this tool
About this tool
Every publicly trusted certificate is recorded in Certificate Transparency logs, and the names on those certificates are public. This tool asks crt.sh for the certificates issued to a domain and its subdomains, and falls back to Cert Spotter if crt.sh is unavailable. It merges the results into one list of names with the date of the first certificate, the latest expiry, how many certificates carry the name, which issuers signed them, and whether a certificate is still valid. Wildcard certificates are listed separately because the names beneath them are covered without being listed. Hints such as staging, admin or mail come only from words in the name and are guesses. The lookup goes through our server and nothing is sent to the domain you enter. A very large domain returns only the most recent certificates and the result says so. A name in a log may no longer exist, and a host that never had a public certificate will not appear.
How to use it
- Enter a domain such as example.com (not an IP address).
- Press Find subdomains and wait; large domains can take up to half a minute.
- Filter by text or by hint, or show only names with a current certificate.
- Copy the names or download them as CSV.
Common problems
- The search says the log service is unavailable
- crt.sh is often overloaded. Wait a minute and try again; the tool also tries Cert Spotter automatically.
- A subdomain I know exists is missing
- Only names on publicly logged certificates appear. Internal hosts, hosts behind a wildcard certificate and hosts that use no HTTPS will not be listed.
- The result says it was truncated
- Very large domains return only the newest certificates. Search a specific subdomain to see its older history.