# CTlogs.io

> Certificate Transparency search. Query CT logs by exact hostname or SHA-256 fingerprint.

CTlogs.io indexes publicly-trusted TLS certificates from major Certificate Transparency logs and provides structured search over the records. Searches return currently valid certificates by default; widening the scope reaches every certificate that expired on or after 1 January 2025. Records older than that are archived and are not served. Listing the subdomains of a domain and searching hostnames for a keyword are DomainKits tools (https://domainkits.com/tools/subdomains, https://domainkits.com/tools/typosquat), from the same team.

## Search modes

- Certificates: certificate records for an exact hostname (issuer, validity window, type, fingerprint, the other names on the certificate)
- Live check: connect to the host and read the certificate it serves right now
- SHA-256: look up a certificate by its fingerprint
- CA certificate: look up one certificate authority by the SHA-256 of its own certificate

## Common uses

Certificate inventory for a hostname, issuer verification, identifying a certificate from a fingerprint, checking what a host serves right now against its logged history, incident forensics.

## Pages

- [Search](https://ctlogs.io/): search interface for certificates by hostname or fingerprint
- [Tools](https://ctlogs.io/tools): five free single-purpose CT lookups, no account required
  - [SSL Certificate History](https://ctlogs.io/tools/certificates): the most recent logged certificates for an exact hostname (up to 50 per query): issuer, validity window, type, fingerprint
  - [Certificate Authority Lookup](https://ctlogs.io/tools/issuer): which certificate authorities have issued for a hostname, and how often
  - [Certificate Fingerprint Lookup](https://ctlogs.io/tools/fingerprint): identify a certificate from its SHA-256 fingerprint
  - [Live Certificate Check](https://ctlogs.io/tools/live): connect to a host on port 443 and read the certificate it serves right now, matched against its logged history
  - [Certificate Authority Detail](https://ctlogs.io/tools/ca): one CA certificate by its SHA-256: what signed it, the cross-signed and re-issued copies of the same subject, and the certificates issued with its key
- [Blog](https://ctlogs.io/blog): how to read Certificate Transparency data, and what it does and does not cover
  - [How to Build an HTTPS Uptime Check That Catches Certificate Failures](https://ctlogs.io/blog/monitor-your-own-certificates): the three certificate failures an uptime check cannot see, why the newest logged certificate is not necessarily the one served, the Live Certificate Check, and a daily routine built on the API
  - [Certificate Transparency logs: what they are, how they work, and how to use them](https://ctlogs.io/blog/certificate-transparency-logs): what a CT log is, the SCT and Merkle tree mechanics, what a log entry contains, five practical uses of CT data, the limits of what it proves, and the operators of the 45 usable or read-only logs in Google's list on 4 September 2026
  - [How to investigate a lookalike domain without visiting it](https://ctlogs.io/blog/investigate-a-lookalike-domain): a triage procedure that reads only the certificate record - the certificate history of the hostname, the other names on the same certificate, the issuer check on your own names, and what the record cannot settle
  - [How to find every subdomain of a domain](https://ctlogs.io/blog/how-to-find-every-subdomain-of-a-domain): what a CT subdomain lookup returns, the three kinds of hostname that never appear in the record, and how DNS brute force, search engines, passive DNS and zone transfer compare
  - [What certificate transparency actually tells you](https://ctlogs.io/blog/what-certificate-transparency-actually-tells-you): the three common misreadings of CT data, and what a log entry does and does not prove
- [Pricing](https://ctlogs.io/pricing): the API plans (Basic, Standard, Pro), their hourly quotas and what they cover
- [FAQ](https://ctlogs.io/faq): what the fields in a result mean: certificate types (DV, OV, EV), the dates, fingerprints, the names on a certificate, scope
- [API documentation](https://ctlogs.io/docs): authentication, rate limits, paging, and the endpoints
- [MCP](https://ctlogs.io/mcp): the MCP connector for AI assistants (lookup_certificates, index_status, account_quota)