Certificate Transparency

Every publicly-trusted TLS certificate is logged to public CT logs. Those logs are a goldmine for subdomains that never appear in DNS brute-forcing — passive and complete.

Query

# crt.sh JSON — all certs (and subdomains) for a domain
curl -s 'https://crt.sh/?q=%25.example.com&output=json' \
  | jq -r '.[].name_value' | sed 's/\*\.//' | sort -u

Web UI: https://crt.sh/?q=example.com. Alternatives: Censys certificates search, and subfinder/amass which query CT among other sources.

What it reveals