OSINT · Recon · PKI
Query public Certificate Transparency logs to enumerate every SSL/TLS certificate ever issued for a domain and its subdomains. Results are deduplicated, wildcard-flagged, expiry-marked, and export-ready — a faster, cleaner alternative to raw crt.sh.
Enter a root domain to query CT logs
Queries crt.sh
Certificate Transparency logs — a public record of every certificate ever issued.
Leading www., http://, and trailing slashes are stripped automatically.
Enumerate every subdomain that has ever had a certificate issued — including staging, dev, and internal-facing hosts that may not appear in DNS. Ideal for external recon and pre-engagement reconnaissance.
Surface subdomains that IT didn't know existed. Wildcard certificates, third-party SaaS integrations, and forgotten test environments all leave traces in CT logs that CertScout surfaces instantly.
Validate that your certificate posture matches expectations. Spot wildcard certs, unexpected issuers, expiring certificates, or certificates issued for hosts that should not be public-facing.
Confirm which certificates have been issued for your organisation's domains. Detect unauthorised issuance events and verify your CA configuration is enforced — without trusting CAA records alone.
Export the full subdomain list as CSV or copy it to clipboard, then pipe directly into tools like Subjack, can-i-take-over-xyz, or the OSINT Tools Takeover scanner to identify dangling DNS records.
Certificate Transparency logs are public by design — every certificate issued by a public CA must be logged. CertScout queries only this public record; no credentials, crawling, or active probing is involved.
Responsible Use: CertScout queries only public Certificate Transparency logs — the same data any browser vendor or CA auditor can access. Use this tool for legitimate security research, asset inventory, and defensive intelligence. Do not use it for unauthorised reconnaissance or harassment. Lookups are subject to rate limits. No query data is stored — only anonymised usage metrics.
Certificate Transparency (CT) is a public, append-only log of every SSL/TLS certificate issued by trusted authorities. Because certificates list their domains and subdomains, searching CT logs is one of the fastest passive ways to enumerate an organization's subdomains and spot newly issued or expiring certificates — with no scanning of the target itself.
CertScout queries the same Certificate Transparency data as crt.sh but returns a deduplicated, sorted subdomain inventory with wildcard flags, expiry markers, and one-click CSV export — instead of crt.sh's raw, repetitive certificate rows. It is built for fast recon and reporting.
Yes. Enter a domain and CertScout returns every hostname that has ever appeared in a public certificate for it. Note this finds subdomains that were issued certificates — combine it with the Takeover tool for active resolution and dangling-record checks.
Yes, it is free with no account or API key required.