Shows every SSL/TLS certificate ever issued for a domain: issuer, validity window, SANs, and serial.
Queries crt.sh certificate transparency logs. Includes expired and revoked certificates.
Queries certificate transparency logs to return the full issuance history for a domain's TLS certificates: issuer, subject, validity period, and sans (subject alternative names). Shows both current and historical certificates.
Certificate transparency is a public ledger that records every certificate issued by participating CAs. All major browsers require CT logging, which means this record is comprehensive and reliable.
Certificate history reveals infrastructure you might not know is still running. An unexpected issuer can indicate a compromised CA relationship or a third-party service issuing certificates on your behalf. Short-lived certificates appearing for subdomains you don't recognize can indicate unauthorized certificate issuance.
SANs in historical certificates often expose subdomains and internal hostnames that were included in multi-domain certificates, providing reconnaissance value beyond what DNS records show.