Free security tool
Every publicly trusted certificate is recorded in Certificate Transparency logs. See which certificates exist for your domain right now, who issued them, and which subdomains they name.
Instant result, no email needed.
A certificate you did not request is a warning sign: a forgotten service, a vendor acting for you, or someone who briefly controlled one of your names. The subdomain names in certificates are also the list attackers start from, so it is worth knowing what is in it. Results come from crt.sh, or from Cert Spotter when crt.sh does not answer; the page names the source. The services differ slightly in coverage and can lag a few hours.
To see which authorities are allowed to issue for the domain, use the CAA Record Checker; to check names for dangling records, the Subdomain Takeover Checker.
A public, append-only record of every certificate issued by publicly trusted authorities. Browsers require it, so a certificate that is not logged is not trusted, which makes the logs a complete public list.
The list shows certificates that are still valid, because those are the ones that can be used today. Expired ones are history.
Authorities log a precertificate before issuing the final certificate. CloudSpex merges the two so each certificate is counted once.
Not for publicly trusted certificates. Use a wildcard certificate if you do not want each name listed, and do not rely on subdomain names being secret.
Add your domain to CloudSpex to monitor its certificates and DNS continuously.
Start Monitoring Free