/api/certs

Every cert ever issued for any domain.

The Certificate Transparency log is public. We wrap crt.sh in a clean JSON API with a 24-hour cache. For brand monitoring, subdomain recon, and security audits.

Try it

curl "https://api.sitetrace.it.com/api/certs?domain=github.com&limit=3" | jq

{
  "domain": "github.com",
  "count": 3,
  "fetched_at": 1735689600,
  "cache": "MISS",
  "certs": [
    {
      "id": 12345678,
      "issuer": "Let's Encrypt R3",
      "issuer_dn": "CN=Let's Encrypt R3, O=Let's Encrypt, C=US",
      "common_name": "github.com",
      "name_value": ["github.com"],
      "not_before": "2025-12-01T00:00:00",
      "not_after": "2026-03-01T00:00:00",
      "serial_number": "03:a1:b2:c3:...",
      "ca": true
    }
    /* ... */
  ]
}

Options

Param	Default	Description
`domain` required	—	The domain to search. Returns every cert issued to it or any subdomain.
`exclude`	—	Comma-separated list of names to skip. Useful for hiding test subdomains.
`limit`	200	Max number of certs to return (1-1000). Sorted newest first.

Use it to

Brand monitoring

Watch for certs issued to lookalike domains. yourbrand.com, your-brand.com, yourbrand-login.com — every phishing-attempt domain leaves a CT trail.

Subdomain discovery

Recon your own footprint. Every subdomain that ever had a cert is in the response. Shadow IT becomes visible.

Cert-renewal monitoring

Poll daily. If a cert's not_after is in the past, your cert was missed at renewal.

Compliance audits

For every domain in your inventory, list the issuing CA and the validity period. Catches mis-issued or non-approved CAs.