Subdomains and certificates

Find the subdomains of a site and all its SSL certificates

Every public SSL certificate lands in open Certificate Transparency logs. They show which subdomains got certificates and when each certificate expires.

Site subdomains as tree branches, each with its own SSL certificate

Where the subdomains come from

Since 2018 browsers only trust certificates recorded in Certificate Transparency logs. Anyone can read these logs, so they reveal every name a certificate was issued for.

Subdomains without a certificate never reach the logs, and neither do names covered by a wildcard like *.example.com. Only the owner of the DNS zone knows the full list.

When it helps

Check whether the site certificate is about to expire and who issued it.
Find forgotten subdomains with test copies of the site.
Collect a competitor's subdomains for SEO research.
Spot a certificate that someone else issued for your domain.

Questions and answers

01Why are some subdomains missing?

The logs only contain names that got public certificates. Subdomains without HTTPS and names under a wildcard certificate do not show up here.

02How do I check when an SSL certificate expires?

Enter the domain: the Current certificate block shows the end date and the days left. Let's Encrypt issues 90-day certificates, so they renew automatically.

03Where does the data come from?

From public Certificate Transparency logs through crt.sh and Cert Spotter. Your browser queries them directly.

04Can I hide a subdomain from certificate logs?

Only with a wildcard certificate for *.example.com: the log gets the mask, not the subdomain name. A certificate for a specific name is published for good.

05Why does the list show subdomains that no longer exist?

The logs keep every issued certificate, old ones included. The subdomain may be gone from DNS while the certificate entry stays. Check its A record to see whether it is alive.