Publicly trusted TLS certificates leave searchable records when certificate authorities submit certificates or precertificates to Certificate Transparency (CT) logs. Reviewing those records helps a domain owner spot unfamiliar hostnames or issuers before comparing them with the approved certificate inventory.

The Cert Spotter API coalesces matching log entries into issuance records and can return currently unexpired certificates for a registered domain plus its descendant subdomains. The API returns a limited page in discovery order, so a complete search advances from the last issuance ID until the next response is an empty JSON array.

A CT record proves that a certificate or precertificate was publicly logged; it does not prove that the issuance was authorized or that the certificate is currently deployed. Similar-looking rows can represent separate issuance events, while private PKI certificates normally remain outside public CT data.

Related: Check a certificate fingerprint with OpenSSL

Steps to search certificate transparency logs for a domain:

  1. Set the target domain to its registrable domain name. 
    $ domain=example.com

    The variable should contain only the registrable domain, such as example.com, without a URL scheme, port, path, or wildcard.

  2. Reset the local Cert Spotter JSON Lines result file. 
    $ : > ct-results.jsonl
  3. Initialize the Cert Spotter pagination cursor without an issuance ID. 
    $ after=

    An empty after value requests the least-recently-discovered page. Each non-empty response supplies the last issuance ID for the next request.

  4. Retrieve every issuance page through the empty terminal response. 
    $ (
>   set -e
>   while :; do
>     curl --fail --silent --show-error --get \
>       --data-urlencode "domain=$domain" \
>       --data-urlencode "include_subdomains=true" \
>       --data-urlencode "expand=dns_names" \
>       --data-urlencode "expand=issuer" \
>       --data-urlencode "after=$after" \
>       --output ct-page.json \
>       https://api.certspotter.com/v1/issuances
>     jq --exit-status 'type == "array"' ct-page.json >/dev/null
>     if [ "$(jq 'length' ct-page.json)" -eq 0 ]; then
>       break
>     fi
>     jq --compact-output '.[]' ct-page.json >> ct-results.jsonl
>     after=$(jq --exit-status --raw-output 'last.id // empty' ct-page.json)
>   done
> )

    The loop keeps the final empty response in ct-page.json and appends each earlier issuance object to ct-results.jsonl. Unauthenticated requests are intended for personal or evaluation use and are rate-limited.

  5. Confirm that the final Cert Spotter response contains zero issuances. 
    $ jq --exit-status 'type == "array" and length == 0' ct-page.json
true

    The command exits nonzero if the saved terminal response is not a JSON array with zero items.

  6. Count the issuance objects saved during pagination. 
    $ jq --slurp 'length' ct-results.jsonl
5

    A count of zero is still a complete search when the preceding terminal-response check prints true.

  7. Review the expiry date, issuer, and DNS names for every saved issuance. 
    $ jq --raw-output \
  '[.not_after, .issuer.friendly_name, (.dns_names | join(", "))] | @tsv' \
  ct-results.jsonl
2026-11-20T23:59:59Z  Sectigo  example.com, example.edu, example.net, example.org
2026-11-21T23:59:59Z  Sectigo  example.com, example.edu, example.net, example.org, www.example.com, www.example.edu, www.example.net, www.example.org
2026-12-02T23:59:59Z  Sectigo  example.com, example.edu, example.net, example.org, www.example.com, www.example.edu, www.example.net, www.example.org
2026-08-29T21:41:26Z  SSL.com  *.example.com, example.com
2026-08-29T21:41:26Z  SSL.com  *.example.com, example.com

    A returned row is logged issuance evidence rather than proof of current deployment, private-key safety, or authorization.

Share this guide