R-CRT
crt.sh
Certificate Transparency log search engine used to enumerate subdomains from issued TLS certificates.
OVERVIEW
Every publicly trusted TLS certificate gets logged in append-only Certificate Transparency logs, and crt.sh indexes them so they're searchable by domain, organization, or issuer. Querying a domain with a leading wildcard (%.target.com) surfaces every subdomain that has ever had a certificate issued for it, including ones no longer in active use.
Because it only reads existing public log data, crt.sh generates zero traffic against the target itself — it's one of the few recon steps that carries no risk of tipping off a defender or touching in-scope infrastructure.
USE CASES
Practical use cases
- 01
Seeding a subdomain list before running active DNS brute-forcing or resolution.
- 02
Finding forgotten staging, dev, or internal-sounding subdomains from old certificates.
- 03
Identifying related organizations or acquisitions via shared certificate issuance patterns.
- 04
Cross-checking a subdomain list from another tool for completeness.
QUICK START
Early passive recon on a domain-scoped engagement, before any active DNS brute-forcing, to seed the subdomain list for free.
- Search crt.sh for %.target.com to list every certificate issued for the domain and its subdomains.
- Export the results (crt.sh supports a JSON output mode) and de-duplicate the common name / SANs into a flat list.
- Filter out expired or clearly decommissioned entries by cross-checking DNS resolution.
- Feed the surviving list into active enumeration tools to confirm which hosts are actually live.
BEFORE YOU RUN IT
What to check before running it
Results only reflect what has ever been publicly certified — internal-only hosts with no public cert, or ones behind an internal CA, won't appear.
A subdomain showing up in a certificate doesn't mean it's still live or in scope; always confirm resolution and ownership before touching anything.
The service is community-run and occasionally rate-limits or returns errors under load — have a fallback source ready.