Skip to content

crt.sh API: Search certificates

Finds certificates issued for a domain and its subdomains on crt.sh, with the DNS names each certificate covers. Expired certificates are excluded unless requested.

crt.sh (opens in a new tab)Version 1ReadNo sign-inVerified Nov 2, 2026

Unofficial. Not affiliated with or endorsed by crt.sh.

Inputs

Values from the run on Oct 23, 2026, shown under Output.

Domain, requireddomain

Domain to search, for example example.com.

example.com

Max Results optionalmax_results

Maximum number of certificates to return, for example 100.

100

Whole number from 1 to 1000. Default 100.

Include Expired optionalinclude_expired

Include expired certificates, for example true.

true

True or false. Default false.

Output

From a run on Oct 23, 2026, shortened for this page.
{  "subdomains": [    "*.example.com",    "dev.example.com",    "example.com"  ],  "certificates": [    {      "link": "https://crt.sh/?id=29581277802",      "crt_sh_id": 29581277802,      "valid_from": "2026-09-26",      "valid_until": "2026-12-25",      "names_covered": [        "*.example.com",        "example.com"      ],      "serial_number": "01eee6aabb521d5e14fc315fd9985690",      "issuer_organization": "SSL Corporation"    },    {      "link": "https://crt.sh/?id=29598205284",      "crt_sh_id": 29598205284,      "valid_from": "2026-09-26",      "valid_until": "2026-12-25",      "names_covered": [        "*.example.com",        "example.com"      ],      "serial_number": "5173da68cc3109eb9472ebf41691c876",      "issuer_organization": "SSL Corporation"    },    {      "link": "https://crt.sh/?id=29557945233",      "crt_sh_id": 29557945233,      "valid_from": "2026-09-24",      "valid_until": "2026-12-21",      "names_covered": [        "*.example.com",        "example.com"      ],      "serial_number": "2caeeaf0743459d7e5f82a75123c58f3",      "issuer_organization": "Sectigo Limited"    }  ]}
Price
1 credit per completed run (1¢ with pay as you go); failed runs are free.
Method
crt.sh/search_certificates
Returns
subdomains, certificates with names, issuer, validity dates, crt.sh link and serial number

Use it from your agent

Give your agent this line. It reads SKILL.md, gets a Fous API key and connects the Fous MCP server. Its run then takes the method crt.sh/search_certificates with the inputs above.

Ask your agent

  • Find all SSL certificates issued for example.com and its subdomains, including the DNS names each one covers
  • Show me certificates for acmecorp.io along with their issuer and validity dates, limited to 50 results
  • List every subdomain that has a certificate under bluebirdbank.net, including expired certificates from the last two years
  • On crt.sh, look up certificates for staging.retailhub.org and its subdomains and give me the serial numbers
  • I need a list of currently valid certificates covering *.nordicfreight.se with issuer names and crt.sh links, maximum 200 entries

See more

  • Finds Rust crates on crates.io by keywords, sorted by relevance, total downloads, recent downloads, or newest creation.

    crates.io/search_crates
  • Finds Coursera courses, specializations, professional certificates, degrees and guided projects on a topic, in Coursera's search order.

    coursera.org/search_courses
  • Finds Chrome Web Store extensions by keywords in store order, with each listing's developer, users, rating, rating count, short description and store link. Some listings omit developer, users or ratings.

    chromewebstore.google.com/search_extensions
  • Searches the npm registry for JavaScript packages by description or keywords, in npm's search order, and returns each package's latest version, weekly downloads and publish date.

    npmjs.com/search_packages
  • Finds public Docker Hub container images matching a software name, in Docker Hub search order, with publisher, badge, stars, last update and exact total pulls when Docker Hub publishes them. Can keep only Docker Official Images and Verified Publisher images.

    hub.docker.com/search_container_images
  • Looks up DNS records for a domain or pasted website link and summarizes its SPF record, DMARC policy and mail servers. A missing record type yields an empty records list.

    dns.google/get_dns_records
  • Finds known vulnerabilities (CVEs) in the NVD that match a product or vendor name, newest first. Each CVE is flagged when it is in CISA's known exploited catalog.

    nvd.nist.gov/search_vulnerabilities
  • Finds companies on Trustpilot by name or what they do, with TrustScore, review count, categories, location, logo and links. A preferred country moves companies listed in that country to the front.

    trustpilot.com/search_companies