Subdomain Finder (Certificate Transparency)
Enter a domain and get back every subdomain that has ever appeared in a publicly-trusted TLS certificate. The data comes from Certificate Transparency (CT) logs, the same public source crt.sh uses, queried through a live index of about 1.1 billion certificate records. This is passive discovery: nothing is sent to the target, and it is not a brute-force or wordlist scan.
Reviewed by the SysGlass team · Updated July 21, 2026
What it checks
- Every subdomain that appears in a certificate a public Certificate Authority has issued for the domain
- The total distinct subdomain count from CT, even when only the first 500 names are displayed
- Each subdomain's certificate expiry date and the date it was first issued
- An 'active certs only' toggle that narrows results to currently-valid (unexpired) certificates
- A has_more flag indicating additional names exist beyond the displayed batch
- Reads only from CT logs (same source as crt.sh) — no DNS probing, open-port checkning, or packets to the target
How to read the result
- OK verdict, e.g. '142 subdomains of example.com ever issued' — these are real hostnames a CA has certified, not guesses
- Each result row shows a subdomain name alongside the expiry date of the certificate it was found in
- 'Count' is the true total of distinct subdomains in CT; the displayed list is capped at 500 names per lookup, and has_more=true means more exist
- With 'active certs only' on, scope changes to 'with currently-valid certificates' — these hosts are more likely to still be live
- Warn verdict 'No certificates found in Certificate Transparency for <domain>' means the domain may be new, parked, internal-only, or mistyped
- Treat the full list as attack surface: look for forgotten dev/staging hosts, admin panels, and wildcard entries (*.example.com)
Frequently asked questions
How does it find subdomains without scanning the target?
Every certificate a publicly-trusted Certificate Authority issues is recorded in public Certificate Transparency (CT) logs, including the hostnames it covers. This tool reads those logged certificate names for your domain. No requests are sent to the target, and there is no DNS brute-forcing or wordlist guessing involved.
Is this the same data as crt.sh?
Yes. It draws from the same underlying Certificate Transparency logs that crt.sh uses, but through an independent index of roughly 1.1 billion certificate records that ingests new CT entries continuously, so results reflect recently issued certificates.
Why are some of my subdomains missing?
Only hostnames that have appeared in a publicly-trusted certificate show up. Subdomains served with self-signed or internal-CA certificates, or hosts covered solely by a wildcard certificate, never appear as distinct names — a wildcard shows as *.example.com rather than each individual host behind it.
What does the 'active certs only' toggle do?
By default the tool lists every subdomain ever certified, including ones whose certificates have since expired. Turning on 'active certs only' restricts results to subdomains that currently hold a valid, unexpired certificate, which is a better proxy for hosts that are still in use.
Is using this legal and safe to run against any domain?
Yes. It only reads public Certificate Transparency logs and sends nothing to the domain you look up, so it is passive reconnaissance against already-public data. It is commonly used by sysadmins to audit their own attack surface and spot forgotten or shadow-IT subdomains.
Why does it show only 500 results when the count is higher?
The displayed list is capped at 500 names per lookup for performance, but the 'count' value always reflects the true total number of distinct subdomains found in CT. When has_more is true, additional names exist beyond the batch shown.