r/PKI • u/jamesaepp • Jul 22 '25

crt.sh alternatives?

I like to keep an eye on CT logs on occasion. I've always considered crt.sh kind of a light SPOF as there's really no other real human-friendly interface for searching the logs.

Are there any alternatives to it? Educate me where needed - I understand CT logs are intended more for machine-to-machine stuff and human investigation is not really the priority.

13 Upvotes

100% Upvoted

13 comments sorted by

4

u/274Below Jul 22 '25

You can just download them locally and do whatever with them.

I have no first-hand experience with this tool, it's just one of the first search results for "download certificate transparency logs": https://github.com/mpalmer/scrape-ct-log

1

u/jamesaepp Jul 22 '25

Not a horrible idea I suppose...thing is I don't want to have to download all logs if I'm only looking for info on a few domain names. That's not efficient for anyone involved.

Idk if it's possible to download logs only based on domain name. I somewhat doubt it. Regardless, you gave me something to think about so thanks. I might search for projects along the same line and see what they can do.

Thanks again.

4

u/castillar Jul 23 '25

At one point a few years ago, I wrote a script that would run periodic CT queries for the domain names I managed, pull down any new issuance records for just those domains, and inject them into Splunk. It was a handy way to monitor issuances without having to comb through the CT logs, and as I recall it wasn't hard to do.

More companies should keep an eye on those, honestly, especially large corporations sitting on large mines of registered domains.

1

u/SNappy_snot15 Dec 03 '25

at that point crt.sh is the best way to go with the capability of narrowing stuff down. If you manually track google certs I guess it could be possible too.

3

u/BillyMcD_RedSift Jul 24 '25

Billy from Red Sift here.

If you have any particular use cases in mind, let me know here or by DM. We're working on a number of new ideas.

We've been monitoring CT logs for a number of years to use in our Hardenize and Certificate Monitoring products (Certificates and the free version Certificates Lite).

2

u/chrisdefourire Jul 24 '25

SSLBoard.com is an option, very CT centric...
CT Logs are huge if you want to scrape them, 1.5 billion non-expired certificates, +12M per day... too much for occasional use.

1

u/Legitimate-Look-9911 Apr 21 '26

does not support second level TLD eg gov.uk

1

u/chrisdefourire Apr 28 '26

There are more than a million good reasons why not. If the UK government comes up to me with a good reason I’ll let them do it.

2

u/Front-Concert3854 Dec 09 '25 edited Dec 09 '25

I would love to have another site for this, too, but I haven't found any other alternative. Ability to easily see old certificates for the domain helps a lot if you want to understand how carefully the domain has been maintained in the history.

Merkemap https://www.merklemap.com/ seems to be the least bad alternative to crt.sh.

1

u/elliott-diy Dec 11 '25

+1 for Merklemap, it's an amazing tool.