SSL Certificate History

All TLS certificates ever issued for a domain from the Certificate Transparency logs: issuer, validity, expiry and the subdomains they name.

Runs on the no.tools server – nothing is stored

About this tool

Since 2018, publicly trusted TLS certificates must be recorded in Certificate Transparency (CT) logs, otherwise browsers reject them. These logs are public, so for any domain you can see which certificates were issued, when and by which certificate authority.

The tool queries the CT search crt.sh and lists a domain’s certificates with issuer, validity period and the names they contain. You can see whether a valid certificate exists and when it expires, whether unexpected authorities issued certificates for your domain, and which subdomains appear in certificates.

How it works

  1. Enter a domain, e.g. example.com. A URL is shortened to the domain name automatically.
  2. Enable “Include subdomains” to also see certificates for www, api or other subdomains.
  3. Click “Search”. At the top you see the count, valid certificates, the next expiry and the issuers.
  4. Below is the list of certificates, newest first. “Details on crt.sh” opens the complete certificate.

Frequently asked questions

Does the tool show the certificate my server currently serves?

Not directly. It shows all certificates recorded in the CT logs; the one being served is usually the newest valid one among them. You can export the certificate actually served via the padlock icon in your browser and inspect it with the SSL Certificate Decoder.

Why does the tool find internal subdomains?

Every name in a public certificate is in the CT logs, including names like internal.example.com. If you do not want to publish internal names, use wildcard certificates or a private certificate authority for them.

Why does the search sometimes take long or fail?

crt.sh is a free service and slow for large domains or under heavy load. Try again without subdomains or a little later. At most the 200 newest certificates are shown.

What data is sent?

Only the domain name. The search runs on the no.tools API because crt.sh does not reliably allow requests directly from the browser. Check a page’s HTTP headers and redirects with the HTTP Header Checker and DNS records with DNS Lookup.

More Security tools

SSL Certificate DecoderDecode X.509 certificates, chains and CSRs: subject, SANs, expiry, key, extensions and fingerprints. PEM or DER, right in your browser.Hash GeneratorCalculate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of text or files — locally, nothing is uploaded.HMAC GeneratorCreate and verify HMAC signatures with SHA-1, SHA-256, SHA-384 and SHA-512 – e.g. for webhooks and APIs. The key never leaves your browser.Password GeneratorCreate strong random passwords and memorable passphrases with a strength meter. Generated locally with your browser’s secure random generator.Password Hash GeneratorHash passwords with bcrypt, Argon2, scrypt or PBKDF2 and verify existing hashes – locally in your browser.Password Strength CheckerCheck how strong a password really is: entropy, crack time, weak patterns like words, sequences or years – and optionally whether it appears in data breaches.SSH Key GeneratorGenerate Ed25519, ECDSA or RSA SSH key pairs in OpenSSH format right in your browser, and check fingerprints and randomart of public keys.Encrypt Text & FilesEncrypt and decrypt text and files with a password or key pair – AES-256-GCM, age and hat.sh, right in your browser. Nothing is uploaded.TOTP / 2FA Code GeneratorShow the current 2FA code for a TOTP secret or otpauth link, or create a new secret with QR code – like an authenticator app, right in your browser.