One HTTP request returns every certificate issued for a hostname — issuer, validity dates, serial, covered names — straight from the public Certificate Transparency logs. Nothing to sign up for, nothing to install.
curl 'https://ctlogs.dev/search?q=example.com&output=json'The response is a JSON document with one row per certificate, newest first:
{
"rows": [
{
"id": "…",
"match": "example.com",
"not_before": "2026-08-30T12:04:11Z",
"not_after": "2026-11-28T12:04:10Z",
"serial_hex": "04a1…",
"issuer": "Let's Encrypt, C=US, O=Let's Encrypt, CN=R13",
"key_algo": "ECDSA P-256",
"san_count": 2,
"domains": ["example.com", "www.example.com"]
}
],
"has_next": false,
"next_cursor": "",
"duration_ms": 41,
"history_window_days": 90
}| not_before / not_after | validity period; a certificate is current when not_after is in the future |
| issuer | the issuing CA, as printed in the certificate |
| serial_hex | serial number, hex — look it up again with ?q=<serial> |
| domains | common name and subject alternative names the certificate covers |
| id | certificate page: https://ctlogs.dev/cert/<id> (add ?output=json for the full record) |
| has_next / next_cursor | pagination — repeat the request with &after=<next_cursor> |
?q=example.com — every certificate whose subject or SAN list names it.?q=*.example.com — every certificate under it, one page at a time.not_after with now; a hostname with no row whose not_after is in the future has no unexpired publicly logged certificate.issuer field — spot certificates from CAs you did not ask for.Data comes from 64 Certificate Transparency logs (56.08B entries ingested, live coverage). Newly issued certificates appear within minutes of being logged.
Anonymous use is free: 100 requests per hour per IP address, one request at a time, and results cover certificates issued in the last 90 days. That is enough for a monitoring check, a CI step or a script that runs a few times an hour.
Need the full history back to 2013, more volume, or serial, SPKI and first-seen lookups? The keyed REST API has the same data with a documented schema and plans by depth.
This is not a live TLS handshake. ctlogs.dev does not connect to the server behind the hostname; it reports what certificate authorities have publicly logged for that name. That makes it the right tool for questions like "which certificates exist for my domain?", "who issued them?" and "does anything expire soon?" — and the wrong tool for "is the certificate this server is serving right now valid?", which needs a TLS client.
No. Add &output=json to any search and you get JSON. A key only matters for volume and history beyond the anonymous limits.
Yes, within the anonymous limits above. Paid plans exist for sustained or historical use on api.ctlogs.dev.
Yes — every certificate issued in the window, current or expired, with its dates. Filter on not_after yourself.
Certificates are ingested continuously from the CT logs; a certificate is normally visible within minutes of issuance. Per-log freshness is on the monitored logs page.
The certificate page (/cert/<id>) shows the parsed fields; ?output=json on it returns the full record. Raw PEM is available for recently issued certificates.