crt.sh alternatives: certificate transparency search tools compared

crt.sh is the best-known free certificate transparency search, and it has returned 502 errors and slow searches for most of 2026. The tool to use instead depends on the question:

Question	Use
Older certificates for a domain, free	crt.sh, when it answers
Current certificates for a domain, by API, free	SSLMate Cert Spotter
Subdomains of a domain, with typo-matching search	Merklemap
Which hosts serve a certificate right now	Censys or Shodan
Certificates issued in the last day, with the domain's DNS, address and registration	issued.live
Domains hosted on an IP address or range, and the certificates issued for them	issued.live (paid plans)

issued.live is this site, and we run it. Prices and free limits below come from each vendor's own pages, checked on 31 October 2026. Where a vendor publishes no price, the table says so.

crt.sh in 2026: 502 errors and a rebuild

crt.sh is run by Sectigo. It needs no account and charges nothing. It searches by name, by SHA-1 or SHA-256 fingerprint and by crt.sh ID, and its advanced search adds CN, SAN, serial and key-ID searches, an option to hide expired certificates, precertificate de-duplication and certificate linting.

The service has struggled through 2026. Users reported 502 errors on the crt.sh mailing list in March, port 5432 timeouts in April, and in May a thread titled with "502 errors for almost a month". On 28 May 2026 Sectigo wrote that it was "painfully aware that crt.sh:443 and crt.sh:5432 have been struggling for some time", put the cause on an indexing strategy that "has not aged well", and described a rebuild of the 68 TB database on PostgreSQL 15 with partitioning. No completion date was given. A user asked for an update on 11 October; the thread had no reply on 31 October.

Our own tests on 1 November 2026, around 01:20 UTC: of four JSON requests (?output=json), three returned HTTP 502 and one returned after six seconds, and plain HTML searches took 21 to 29 seconds. Five minutes later, none of six requests succeeded. A JSON search for github.com timed out after 60 seconds with no data, and the other five returned HTTP 502 within half a second, including the page for a single certificate (?id=1).

When crt.sh does answer, three habits keep queries small: tick "Exclude expired" in the advanced search, de-duplicate precertificates, and search one exact name before a % wildcard. Sectigo also names crt.sh:5432 as a public PostgreSQL endpoint for direct SQL.

Certificate transparency search tools that no longer exist

Older "crt.sh alternative" lists still recommend tools that have closed:

• Google Transparency Report certificate search: discontinued in May 2022, per Google's own changelog for the report.
• Meta (Facebook) Certificate Transparency Monitoring: developers.facebook.com/tools/ct/ and its documentation pages returned HTTP 404 on 31 October 2026. Meta has published no retirement date that we could find.
• Entrust CT search: ui.ctsearch.entrust.com no longer resolves. Entrust sold its public certificate business to Sectigo in January 2025.
• Cloudflare Merkle Town: ct.cloudflare.com now redirects to Cloudflare Radar's certificate transparency page, which shows issuance statistics and has no per-domain search.

SSLMate Cert Spotter

Cert Spotter is the closest match to crt.sh for scripts. Its CT Search API takes a domain and returns its certificates as JSON:

curl -sS "https://api.certspotter.com/v1/issuances?domain=example.com&include_subdomains=true&expand=dns_names"

• Free: 100 single-hostname queries an hour and 10 full-domain queries an hour. SSLMate's documentation allows unauthenticated queries for personal and evaluation use.
• Paid: CT Search API Medium $50 a month, Large $500 a month, and a full firehose at $1,000 a month.
• Monitoring: from $15 a month (Hobbyist, 20 endpoints), with a 30-day trial. The open-source certspotter monitor on GitHub runs on your own machine at no cost.
• Limits: the API returns unexpired certificates only, and searches by domain only. There is no search by IP address, public key or issuer.

Censys

Censys combines certificate data with internet-wide scans, so it answers which hosts present a certificate as well as which names it covers.

• Free: 100 credits a month with an account. A search, a lookup, an extra results page or a filter each cost one credit.
• Paid: no published price. Every paid tier is "Contact sales". Censys lists data history of 1+ month, 3+ months and 12+ months by tier.

Merklemap

Merklemap indexes certificate transparency for subdomain discovery. Its search supports wildcards and a Levenshtein "distance" mode that finds names a few characters away from the query, which suits lookalike-domain hunting. It also sells a live stream of newly seen hostnames.

• Price: one plan at EUR 49 a month with 100,000 requests, covering the API and the website.
• Free: the API requires the paid plan. Free website limits and history depth are not published.

Shodan

Shodan sees certificates by scanning hosts and reading the certificate each one serves, and exposes them under ssl.cert search filters. A certificate that was issued but never deployed on a scanned address does not appear, so Shodan shows where a certificate is in use.

• Price: Membership is a one-time $49. API plans start at $69 a month (Freelancer), then $359 and $1,099.

issued.live

issued.live reads every public CT log continuously and joins each certificate to the domain's DNS from seven resolver vantage points, its hosting address and network, and its registration data from ICANN zone files. The free lookup needs no account or key and returns JSON to curl:

curl -sS https://issued.live/github.com

The response carries the current certificate ID, issuer and expiry, the hosting address, registration and expiry dates, and when a certificate for the name was first seen in CT. The same URL returns Markdown with .md appended, and a web page in a browser. Free use is 1,000 requests a day per address. https://issued.live/api/feed streams certificates as they are logged, over a rolling 30-minute window, also without a key.

Paid plans add search by address, certificate, key and name pattern:

• Plus, $99 a month: reverse IP and CIDR lookup (every domain hosted on an address or range), certificate lookup by ID or SHA-256 with its full SAN list, and every certificate sharing one public key (SPKI) among certificates first seen in the last 32 hours. How the range lookup works is in find domains in an IP range.
• Pro, $199 a month: pattern search across all registrable domains (*agent.com, loop-*.com), batch lookup of 500 domains in one call, the newly registered domains feed, and every certificate issued for the hostnames seen on one IP address.
• Every keyed endpoint is also a tool on the issued.live MCP server at https://issued.live/mcp, on the same plan, for AI assistants.

Domains hosted on an IP address

Threat researchers pivot from one domain to its server, then from the server to every other domain hosted there. A certificate records the names it covers and nothing about where they are hosted, so crt.sh, Cert Spotter and Merklemap have no IP search.

• Censys and Shodan scan IP addresses and show what each one serves at scan time, including the names on the certificate it presents.
• issued.live resolves every name it sees in CT logs and zone files from its own resolvers and keeps each address a name answered with, with no expiry. The reverse IP lookup on Plus returns every domain hosted on an address, with first-seen and last-seen dates. Observations begin in August 2026.

curl -sS https://issued.live/api/v1/ip/185.199.108.133 \
  -H "Authorization: Bearer $ISSUED_LIVE_KEY"

first_seen_from and first_seen_to restrict the list to domains first seen on the address inside a time window, such as the names that moved onto a server this week. /api/v1/range/{cidr} runs the same lookup across up to 256 addresses, covered in find domains in an IP range. On Pro, /api/v1/ip/{ip}/certs returns every certificate issued for the hostnames seen on the address, in issuance order.

SSL certificate history for a domain

Certificate history is where the tools differ most:

• crt.sh holds the largest dataset of the free tools, a 68 TB database by Sectigo's count, subject to the availability problems above.
• Cert Spotter returns unexpired certificates only, so it shows what is valid today.
• Censys keeps 1 to 12+ months of data depending on the paid tier.
• issued.live keeps certificates queryable for 32 hours. Pro searches the permanent archive from 9 September 2026 onward, and the daily certificate files are archived permanently from 17 September 2026. For a domain's certificates from before September 2026, use crt.sh.

Prices and free limits

Tool	Free tier	Paid from	Search by
crt.sh	No account; no published rate limit	No paid tier	Name, fingerprint, ID, CN, SAN, serial, key ID
Cert Spotter	100 hostname queries/hour, 10 full-domain/hour	$50/month (API), $15/month (monitoring)	Domain
Censys	100 credits/month, account required	Not published	Certificates, hosts
Merklemap	Website only; limits not published	EUR 49/month	Domain, wildcard, edit distance
Shodan	Account; filter access not documented	$49 once, API $69/month	Hosts, certificate fields
issued.live	1,000 requests/day, no account	$39/month; searches from $99/month	Domain, IP, CIDR, certificate, public key, name pattern

Sources: crt.sh, the crt.sh mailing list, SSLMate CT Search API, Cert Spotter pricing, Censys free credits, Censys pricing, Merklemap pricing, Shodan plans, Google Transparency Report changelog, and issued.live pricing. Prices change; check the vendor before buying.

For bulk domain lists and zone files, the issued.live comparison page covers AllZonefiles.io, Domains-Monitor and WhoisXML API.