{"slug": "crt-sh", "name": "crt.sh", "category": "search", "category_name": "Search", "description": "", "recommenders": 5, "commenters": 9, "warners": 1, "score": 4.361, "rising": 1.02, "first": "2025-11-30", "latest": "2026-09-15", "why": "You could just pull tls cert registrations CT logs, way easier. Or https://crt.sh", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 5, "neutral": 3, "compare": 0, "warn": 1}, "spark": [0, 1, 0, 1, 1, 0, 0, 0, 0, 1, 1, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "You could just pull tls cert registrations CT logs, way easier. Or https://crt.sh", "kind": "", "icon": true, "domain": "crt.sh", "github_repo": null, "official_url": "https://crt.sh", "pricing": "", "aliases": ["crt.sh"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 795483873, "item_id": 49717742, "url": "https://news.ycombinator.com/item?id=49717742", "by": "PaoloBarbolini", "date": "2026-09-15", "version": null, "stance": "recommend", "quote": "Lookup certificate transparency and continue from there", "excerpt": "Even something like Qwen 3.8 27b could do this. Lookup certificate transparency and continue from there https://crt.sh/?Identity=baseten.co&exclude=expired&match=ILIKE", "context": "", "use_case": "", "switched_from": "", "story": "We got admin access to Baseten's production GitHub"}, {"id": 786507856, "item_id": 49156741, "url": "https://news.ycombinator.com/item?id=49156741", "by": "esseph", "date": "2026-08-03", "version": null, "stance": "recommend", "quote": "You could just pull tls cert registrations CT logs, way easier. Or https://crt.sh", "excerpt": "You could just pull tls cert registrations CT logs, way easier. Or https://crt.sh", "context": "", "use_case": "finding domains via CT logs", "switched_from": "", "story": "Ask HN: What are the viable alternatives to DuckDuckGo?"}, {"id": 758547168, "item_id": 47409198, "url": "https://news.ycombinator.com/item?id=47409198", "by": "that_lurker", "date": "2026-03-16", "version": null, "stance": "recommend", "quote": "https://crt.sh is a nice sit where you can see your domains certificate transparency logs", "excerpt": "https://crt.sh is a nice sit where you can see your domains certificate transparency logs", "context": "", "use_case": "Certificate transparency lookup", "switched_from": "", "story": "Ask HN: How do I make UK and US hosters disown Russian Firewall?"}, {"id": 753276561, "item_id": 47079785, "url": "https://news.ycombinator.com/item?id=47079785", "by": "tialaramex", "date": "2026-02-19", "version": null, "stance": "recommend", "quote": "https://crt.sh/?id=23696530376", "excerpt": "Although the poisoned pre-certificates\u2020 are logged as a necessary part of offering the least hassle product which is the business Let's Encrypt are in, they, like most CAs, also log the finished certificate shortly after. Here's the pre-certificate for this web site's current certificate: https://crt.sh/?id=23696530376 and here, just a few later in the log, is the finished certificate: https://crt.sh/?id=23696528656 ", "context": "", "use_case": "", "switched_from": "", "story": "DNS-Persist-01: A New Model for DNS-Based Challenge Validation"}, {"id": 740408176, "item_id": 46275511, "url": "https://news.ycombinator.com/item?id=46275511", "by": "H8crilA", "date": "2025-12-15", "version": null, "stance": "recommend", "quote": "For those that never looked at the CT logs: https://crt.sh/?q=ycombinator.com", "excerpt": "For those that never looked at the CT logs: https://crt.sh/?q=ycombinator.com (the site may occasionally fail to load)", "context": "", "use_case": "Searching certificate transparency logs", "switched_from": "", "story": "It seems that OpenAI is scraping [certificate transparency] logs"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 748160032, "item_id": 46760002, "url": "https://news.ycombinator.com/item?id=46760002", "by": "eric_trackjs", "date": "2026-01-25", "version": null, "stance": "warn", "quote": "crt.sh can be woefully unreliable.", "excerpt": "crt.sh is a wonderful tool. I applaud anyone who makes CT log searching more available! That said, crt.sh can be woefully unreliable. It often returns errors during a query or is just hard down. Large result sets may never return. Queries often take a very long time. I wanted a more reliable CT log search tool for something I'm working on, so I built a purpose built CT log search tool. I ingest all the data from the ", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: CertRadar \u2013 Find every certificate ever issued for your domain"}]}], "who": [], "tags": [], "use_cases": ["certificate transparency lookup", "finding domains via ct logs", "searching certificate transparency logs"], "compared": [{"slug": "let-s-encrypt", "name": "Let's Encrypt", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49716476", "title": "We got admin access to Baseten's production GitHub", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49155492", "title": "Ask HN: What are the viable alternatives to DuckDuckGo?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47396430", "title": "Ask HN: How do I make UK and US hosters disown Russian Firewall?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47064047", "title": "DNS-Persist-01: A New Model for DNS-Based Challenge Validation", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46943865", "title": "Is the author of pdf-lib okay?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46895972", "title": "When internal hostnames are leaked to the clown", "mentions": 1}], "sentiment_by_month": {"2025-11": {"neutral": 1}, "2025-12": {"recommend": 1}, "2026-01": {"warn": 1}, "2026-02": {"neutral": 2, "recommend": 1}, "2026-03": {"recommend": 1}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {}, "2026-08": {"recommend": 1}, "2026-09": {"recommend": 1}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 795483873, "item_id": 49717742, "url": "https://news.ycombinator.com/item?id=49717742", "by": "PaoloBarbolini", "date": "2026-09-15", "version": null, "stance": "recommend", "quote": "Lookup certificate transparency and continue from there", "excerpt": "Even something like Qwen 3.8 27b could do this. Lookup certificate transparency and continue from there https://crt.sh/?Identity=baseten.co&exclude=expired&match=ILIKE", "context": "", "use_case": "", "switched_from": "", "story": "We got admin access to Baseten's production GitHub"}, {"id": 786507856, "item_id": 49156741, "url": "https://news.ycombinator.com/item?id=49156741", "by": "esseph", "date": "2026-08-03", "version": null, "stance": "recommend", "quote": "You could just pull tls cert registrations CT logs, way easier. Or https://crt.sh", "excerpt": "You could just pull tls cert registrations CT logs, way easier. Or https://crt.sh", "context": "", "use_case": "finding domains via CT logs", "switched_from": "", "story": "Ask HN: What are the viable alternatives to DuckDuckGo?"}, {"id": 758547168, "item_id": 47409198, "url": "https://news.ycombinator.com/item?id=47409198", "by": "that_lurker", "date": "2026-03-16", "version": null, "stance": "recommend", "quote": "https://crt.sh is a nice sit where you can see your domains certificate transparency logs", "excerpt": "https://crt.sh is a nice sit where you can see your domains certificate transparency logs", "context": "", "use_case": "Certificate transparency lookup", "switched_from": "", "story": "Ask HN: How do I make UK and US hosters disown Russian Firewall?"}, {"id": 753276561, "item_id": 47079785, "url": "https://news.ycombinator.com/item?id=47079785", "by": "tialaramex", "date": "2026-02-19", "version": null, "stance": "recommend", "quote": "https://crt.sh/?id=23696530376", "excerpt": "Although the poisoned pre-certificates\u2020 are logged as a necessary part of offering the least hassle product which is the business Let's Encrypt are in, they, like most CAs, also log the finished certificate shortly after. Here's the pre-certificate for this web site's current certificate: https://crt.sh/?id=23696530376 and here, just a few later in the log, is the finished certificate: https://crt.sh/?id=23696528656 ", "context": "", "use_case": "", "switched_from": "", "story": "DNS-Persist-01: A New Model for DNS-Based Challenge Validation"}, {"id": 751114464, "item_id": 46944654, "url": "https://news.ycombinator.com/item?id=46944654", "by": "dhx", "date": "2026-02-09", "version": null, "stance": "neutral", "quote": "The SANs associated with https://crt.sh/?q=andrewjdillon.com", "excerpt": "The SANs associated with https://crt.sh/?q=andrewjdillon.com are extremely suspicious. They reminded me straight away of https://ourbigbook.com/cirosantilli/cia-2010-covert-communication-websites There appears to be no obvious plausible link between the SANs other than very obvious lack of plausibility to each website. They're mostly pretend (or knock-off) business websites in random countries (everywhere from Trinid", "context": "", "use_case": "certificate transparency lookup", "switched_from": "", "story": "Is the author of pdf-lib okay?"}, {"id": 750351200, "item_id": 46896950, "url": "https://news.ycombinator.com/item?id=46896950", "by": "bardsore", "date": "2026-02-04", "version": null, "stance": "neutral", "quote": "the wildcard cert she mentions is visible to the public on sites such as https://crt.sh/", "excerpt": "Unless she hosts her own cert authority or is using a self-signed cert, the wildcard cert she mentions is visible to the public on sites such as https://crt.sh/.", "context": "", "use_case": "", "switched_from": "", "story": "When internal hostnames are leaked to the clown"}, {"id": 748160032, "item_id": 46760002, "url": "https://news.ycombinator.com/item?id=46760002", "by": "eric_trackjs", "date": "2026-01-25", "version": null, "stance": "warn", "quote": "crt.sh can be woefully unreliable.", "excerpt": "crt.sh is a wonderful tool. I applaud anyone who makes CT log searching more available! That said, crt.sh can be woefully unreliable. It often returns errors during a query or is just hard down. Large result sets may never return. Queries often take a very long time. I wanted a more reliable CT log search tool for something I'm working on, so I built a purpose built CT log search tool. I ingest all the data from the ", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: CertRadar \u2013 Find every certificate ever issued for your domain"}, {"id": 740408176, "item_id": 46275511, "url": "https://news.ycombinator.com/item?id=46275511", "by": "H8crilA", "date": "2025-12-15", "version": null, "stance": "recommend", "quote": "For those that never looked at the CT logs: https://crt.sh/?q=ycombinator.com", "excerpt": "For those that never looked at the CT logs: https://crt.sh/?q=ycombinator.com (the site may occasionally fail to load)", "context": "", "use_case": "Searching certificate transparency logs", "switched_from": "", "story": "It seems that OpenAI is scraping [certificate transparency] logs"}, {"id": 737672800, "item_id": 46104550, "url": "https://news.ycombinator.com/item?id=46104550", "by": "udev4096", "date": "2025-11-30", "version": null, "stance": "neutral", "quote": "I don't see any \"machine name\" on crt.sh", "excerpt": "What do you mean? I used self-signed for communication b/w LB and the nginx serving backend Edit: I don't see any \"machine name\" on crt.sh for public LB which uses LE Ah, you meant the DNS address is on CT now. You think I wouldn't know that? Regardless, a dns01 challenge is far better than using self-signed at home", "context": "", "use_case": "", "switched_from": "", "story": "\u201cBoobs check\u201d \u2013 Technique to verify if sites behind CDN are hosted in Iran"}]}