Subdomain Finder: Certificate Transparency

Every subdomain of a domain, from public Certificate Transparency logs.

{ "domains": ["apify.com"] }

Why CT logs beat a wordlist

Most subdomain tools brute-force a dictionary against DNS: thousands of queries, noisy, and it finds only names someone thought to put in the list.

Certificate Transparency is the opposite. Since 2018 every certificate a public CA issues must be published to append-only logs, or browsers reject it. So any host that has ever been served over HTTPS is already public record, including the ones nobody would guess: jenkins-old., vpn-test., internal-api-staging.

No brute force. No DNS hammering. Nothing that looks like an attack in someone's logs.

Deduplication is the whole job

Raw CT output for one mid-size domain is routinely ten times more rows than there are real hosts. A single certificate carries many SANs, every 90-day renewal republishes them all, and wildcards arrive as *.example.com.

A raw query against apify.com returns around 958 certificate records. This returns the distinct hostnames, and you are billed for those, not for the duplicates.

Each row aggregates every certificate seen for that host:

Field
hostname	the subdomain
depth	label count, sort by it to see structure
firstSeen	earliest notBefore across all its certificates
lastSeen	latest notAfter, when coverage runs out
certificateActive	true if a certificate is valid right now
certificates	how many certificates named this host
issuers	which CAs issued them
isWildcard	*. entry rather than a concrete host

Live hosts vs. history

By default you get hosts with unexpired certificates, the current attack surface.

{ "domains": ["example.com"], "includeExpired": true }

Turn on includeExpired and you also get everything that used to exist. Decommissioned staging servers and forgotten legacy hosts show up here, and in a security review that is usually the interesting half.

Use cases

• Attack-surface mapping: the full external footprint of a domain you are authorised to assess
• Asset inventory: find hosts that never made it into the CMDB
• Shadow IT discovery: teams that stood up their own subdomain
• M&A diligence: what does the target actually run
• Certificate expiry: sort by lastSeen, find coverage about to lapse
• Bug bounty recon: within the program's declared scope

Pricing

Charged per unique hostname returned, not per certificate record. A domain with no certificates in CT produces an error row and costs $0.00.

Subdomain enumeration without touching the target

Every TLS certificate a public CA issues is published to append-only Certificate Transparency logs. That makes CT the one subdomain source that is both complete for anything HTTPS-served and entirely public.

What that rules out, which is the point:

The usual approach	Why CT is better
Brute-force wordlist	only finds names you already guessed; CT lists what exists
DNS zone transfer	almost always refused, and noisy when attempted
Hammering a resolver	thousands of queries against someone else's infrastructure

Nothing here contacts the target. No probing, no resolving, no port scan, no connection to any host found. The certificates were published by the CAs, and this reads the published record.

Per hostname, deduplicated to one row each: the hostname, whether it is a wildcard, subdomain depth, first and last seen, how many certificates covered it, the issuing CAs, and whether a covering certificate is currently valid.

includeExpired is off by default, which gives the hosts that are live now. Turn it on for the historical view, where decommissioned staging and legacy hosts show up, and that is often exactly what a security review wants.

Raw CT output for one domain is routinely ten times duplicates, since a certificate carries many SANs and names repeat across every renewal. Deduplicating is not a nicety here, it is the difference between billing for 958 rows and for 94 real hosts.

Do you need an API key? No. Is there a free tier? Yes.

The two things people search for in this category, measured, are free and API key: subdomain finder api free, subdomain finder api key.

So, plainly:

• No API key. Nothing to register for, nothing to rotate, no key to leak in a repo. The source is a public API published deliberately by its owner.
• No proxy setup. The source does not bot-wall datacenter addresses, so the default works.
• Pay per result, not per month. There is no subscription and no minimum. Rows that error or that your filters drop are not charged.
• Free to try. Run it with the prefilled input and see real rows before deciding anything.

Notes

• Public record only. CT logs are a published, append-only, legally mandated transparency mechanism. This reads them. It does not probe, resolve, port-scan or connect to any host it finds.
• A hostname in CT means a certificate was issued for it. It does not guarantee the host resolves or is reachable today: certificateActive tells you about the certificate, not about DNS.
• Two CT front ends, not one. crt.sh is tried first because it has the deeper history. When it will not serve the request, the run falls back to Cert Spotter automatically and you get the same fields either way. Certificate Transparency is a public append-only log with several readers, so depending on a single front end was never a good reason to fail a run.
• Queries against large domains can take 10-20 seconds; crt.sh runs a database scan behind an HTTP front end, and the client timeout is raised to 90s to accommodate it.
• Under load crt.sh sometimes answers with an HTML error page instead of an HTTP error code. That is detected and reported as a retryable failure rather than parsed as empty results.
• A 404 from crt.sh is not "no certificates found." crt.sh reports that as HTTP 200 with an empty list; a 404 is the service refusing traffic. Reading the two as the same thing is how a subdomain tool tells you a domain with thousands of logged certificates has none, and exits successfully. The refusal is retried on a fresh IP, then failed over, and only ever reported as what it is.

FAQ

How is this different from a brute-force subdomain finder?

A wordlist tool fires thousands of DNS queries and finds only names someone thought to add to the list. Certificate Transparency is a published, append-only log that every public CA is required to write to, so any host ever served over HTTPS is already public record, including the ones nobody would guess. No DNS hammering, and nothing that looks like an attack in someone's logs.

Is this legal?

It reads a legally mandated public transparency mechanism. It does not probe, resolve, port-scan or connect to any host it finds. Use it on domains you own or are authorised to assess. That authorisation is your responsibility, not a property of the data.

Does a hostname in the results mean the host is live?

No, and this is the most common misreading. A hostname in CT means a certificate was issued for it. certificateActive tells you whether a certificate is valid right now. It says nothing about whether DNS resolves or the host answers.

How do I find decommissioned or forgotten hosts?

Set includeExpired: true. The default returns hosts with unexpired certificates, which is the current attack surface; expired entries are where old staging servers and forgotten legacy hosts live, and in a security review that is usually the interesting half.

Am I charged per certificate or per hostname?

Per unique hostname. Raw CT output for a mid-size domain is routinely ten times more records than there are real hosts, because one certificate carries many SANs and every 90-day renewal republishes them all. A raw query against apify.com returns about 958 certificate records; you are billed for the distinct hostnames that come out of them.

Why is a run slow?

crt.sh runs a database scan behind an HTTP front end, so large domains can take 10-20 seconds. The client timeout is raised to 90s for that reason.

Can I find wildcard certificates?

Yes. They arrive as *.example.com rows with isWildcard: true, so you can include or filter them deliberately.