crt.sh Has a Free API — Find Every SSL Certificate for Any Domain (With Python)

#api #python #webdev #security

Want to find every subdomain of any website? There's a trick most developers don't know.

Every time a website gets an SSL certificate, it gets logged in a public database called Certificate Transparency logs. And crt.sh lets you search all of them — for free, with no API key.

This means you can find every subdomain of any domain that has ever had an SSL certificate.

Why This Is Useful

Security audits: Find forgotten subdomains (staging.company.com, dev.company.com)
Bug bounty: Discover attack surface of target domains
Competitive analysis: See what internal tools competitors are running
Monitoring: Get alerts when new certificates are issued for your domain

Quick Start

crt.sh has no official docs, but it supports a simple JSON API:

import requests

def find_subdomains(domain):
    """Find all subdomains via Certificate Transparency logs."""
    url = f"https://crt.sh/?q=%25.{domain}&output=json"
    resp = requests.get(url, timeout=30)

    if resp.status_code != 200:
        return []

    certs = resp.json()
    subdomains = set()

    for cert in certs:
        name = cert.get('name_value', '')
        for sub in name.split('\n'):
            sub = sub.strip().lower()
            if sub and '*' not in sub:
                subdomains.add(sub)

    return sorted(subdomains)

# Example: Find all subdomains of a company
subs = find_subdomains('github.com')
print(f'Found {len(subs)} subdomains for github.com:')
for s in subs[:20]:
    print(f'  {s}')

Output:

Found 847 subdomains for github.com:
  alive.github.com
  api.github.com
  assets-cdn.github.com
  classroom.github.com
  cloud.github.com
  codespaces.github.com
  ...

847 subdomains for github.com. Imagine running this on your competitor's domain.

Advanced: Monitor New Certificates

import time
from datetime import datetime, timedelta

def monitor_new_certs(domain, hours=24):
    """Find certificates issued in the last N hours."""
    url = f"https://crt.sh/?q=%25.{domain}&output=json"
    resp = requests.get(url, timeout=30)
    certs = resp.json()

    cutoff = datetime.now() - timedelta(hours=hours)
    new_certs = []

    for cert in certs:
        issued = cert.get('not_before', '')
        if issued:
            try:
                issued_dt = datetime.fromisoformat(issued.replace('T', ' ').split('.')[0])
                if issued_dt > cutoff:
                    new_certs.append({
                        'domain': cert['name_value'],
                        'issuer': cert.get('issuer_name', ''),
                        'issued': issued
                    })
            except ValueError:
                pass

    return new_certs

# Check what certs were issued for your domain in last 24h
new = monitor_new_certs('yourcompany.com', hours=24)
for c in new:
    print(f"NEW CERT: {c['domain']} (issued: {c['issued']})")

Run this as a cron job and you'll know within hours when someone gets a cert for a subdomain of your domain — which could mean a phishing attack.

Combine With Other Tools

import shodan

# Step 1: Find subdomains via crt.sh
subdomains = find_subdomains('target.com')

# Step 2: Check each subdomain for open ports via Shodan
api = shodan.Shodan('YOUR_SHODAN_KEY')
for sub in subdomains[:10]:
    try:
        host = api.host(sub)
        print(f'{sub}: ports {host["ports"]}')
    except shodan.APIError:
        pass