$ man crt-name
crt.name
Every TLS certificate ever issued for your domain - and the subdomains in them.
osint / reconpassive / local only
⚠ Recon your own assets, or targets you have written permission to test. Passive OSINT reads public data, but using it to target someone else's systems can still be illegal or against their terms. Examples on this site use example.com placeholders.
## why a developer should care
Certificate Transparency logs are public by design. Every time someone got a certificate for staging.yourapp.com or old-admin.yourapp.com, it was logged forever. This is usually the first thing an attacker checks.
## shortcuts
# All unique names from certificates for a domain
$ curl -s "https://crt.name/v1/search?apex={{target}}" | grep -oiE '([a-z0-9_*-]+\.)*{{target}}' | sort -u# See the raw response
$ curl -s "https://crt.name/v1/search?apex={{target}}" | head -40