# crt.sh alternatives: certificate transparency search tools compared Published: 2026-11-01T16:17:01Z Author: Daniel Jones Tags: certificate transparency,osint,threat hunting,domains hosted on ip,reverse ip lookup,crtsh,cert spotter,censys,ssl certificate history,issuedlive Canonical: https://issued.live/news/crt-sh-alternatives-certificate-transparency-search --- crt.sh is the best-known free certificate transparency search, and it has returned 502 errors and slow searches for most of 2026. The tool to use instead depends on the question: QuestionUse Older certificates for a domain, freecrt.sh, when it answers Current certificates for a domain, by API, freeSSLMate Cert Spotter Subdomains of a domain, with typo-matching searchMerklemap Which hosts serve a certificate right nowCensys or Shodan Certificates issued in the last day, with the domain's DNS, address and registrationissued.live Domains hosted on an IP address or range, and the certificates issued for themissued.live (paid plans) issued.live is this site, and we run it. Prices and free limits below come from each vendor's own pages, checked on 31 October 2026. Where a vendor publishes no price, the table says so. crt.sh in 2026: 502 errors and a rebuild crt.sh is run by Sectigo. It needs no account and charges nothing. It searches by name, by SHA-1 or SHA-256 fingerprint and by crt.sh ID, and its advanced search adds CN, SAN, serial and key-ID searches, an option to hide expired certificates, precertificate de-duplication and certificate linting. The service has struggled through 2026. Users reported 502 errors on the crt.sh mailing list in March, port 5432 timeouts in April, and in May a thread titled with "502 errors for almost a month". On 28 May 2026 Sectigo wrote that it was "painfully aware that crt.sh:443 and crt.sh:5432 have been struggling for some time", put the cause on an indexing strategy that "has not aged well", and described a rebuild of the 68 TB database on PostgreSQL 15 with partitioning. No completion date was given. A user asked for an update on 11 October; the thread had no reply on 31 October. Our own tests on 1 November 2026, around 01:20 UTC: of four JSON requests (?output=json), three returned HTTP 502 and one returned after six seconds, and plain HTML searches took 21 to 29 seconds. Five minutes later, none of six requests succeeded. A JSON search for github.com timed out after 60 seconds with no data, and the other five returned HTTP 502 within half a second, including the page for a single certificate (?id=1). When crt.sh does answer, three habits keep queries small: tick "Exclude expired" in the advanced search, de-duplicate precertificates, and search one exact name before a % wildcard. Sectigo also names crt.sh:5432 as a public PostgreSQL endpoint for direct SQL. Certificate transparency search tools that no longer exist Older "crt.sh alternative" lists still recommend tools that have closed: Google Transparency Report certificate search: discontinued in May 2022, per Google's own changelog for the report. Meta (Facebook) Certificate Transparency Monitoring: developers.facebook.com/tools/ct/ and its documentation pages returned HTTP 404 on 31 October 2026. Meta has published no retirement date that we could find. Entrust CT search: ui.ctsearch.entrust.com no longer resolves. Entrust sold its public certificate business to Sectigo in January 2025. Cloudflare Merkle Town: ct.cloudflare.com now redirects to Cloudflare Radar's certificate transparency page, which shows issuance statistics and has no per-domain search. SSLMate Cert Spotter Cert Spotter is the closest match to crt.sh for scripts. Its CT Search API takes a domain and returns its certificates as JSON: curl -sS "https://api.certspotter.com/v1/issuances?domain=example.com&include_subdomains=true&expand=dns_names" Free: 100 single-hostname queries an hour and 10 full-domain queries an hour. SSLMate's documentation allows unauthenticated queries for personal and evaluation use. Paid: CT Search API Medium $50 a month, Large $500 a month, and a full firehose at $1,000 a month. Monitoring: from $15 a month (Hobbyist, 20 endpoints), with a 30-day trial. The open-source certspotter monitor on GitHub runs on your own machine at no cost. Limits: the API returns unexpired certificates only, and searches by domain only. There is no search by IP address, public key or issuer. Censys Censys combines certificate data with internet-wide scans, so it answers which hosts present a certificate as well as which names it covers. Free: 100 credits a month with an account. A search, a lookup, an extra results page or a filter each cost one credit. Paid: no published price. Every paid tier is "Contact sales". Censys lists data history of 1+ month, 3+ months and 12+ months by tier. Merklemap Merklemap indexes certificate transparency for subdomain discovery. Its search supports wildcards and a Levenshtein "distance" mode that finds names a few characters away from the query, which suits lookalike-domain hunting. It also sells a live stream of newly seen hostnames. Price: one plan at EUR 49 a month with 100,000 requests, covering the API and the website. Free: the API requires the paid plan. Free website limits and history depth are not published. Shodan Shodan sees certificates by scanning hosts and reading the certificate each one serves, and exposes them under ssl.cert search filters. A certificate that was issued but never deployed on a scanned address does not appear, so Shodan shows where a certificate is in use. Price: Membership is a one-time $49. API plans start at $69 a month (Freelancer), then $359 and $1,099. issued.live issued.live reads every public CT log continuously and joins each certificate to the domain's DNS from seven resolver vantage points, its hosting address and network, and its registration data from ICANN zone files. The free lookup needs no account or key and returns JSON to curl: curl -sS https://issued.live/github.com The response carries the current certificate ID, issuer and expiry, the hosting address, registration and expiry dates, and when a certificate for the name was first seen in CT. The same URL returns Markdown with .md appended, and a web page in a browser. Free use is 1,000 requests a day per address. https://issued.live/api/feed streams certificates as they are logged, over a rolling 30-minute window, also without a key. Paid plans add search by address, certificate, key and name pattern: Plus, $99 a month: reverse IP and CIDR lookup (every domain hosted on an address or range), certificate lookup by ID or SHA-256 with its full SAN list, and every certificate sharing one public key (SPKI) among certificates first seen in the last 32 hours. How the range lookup works is in find domains in an IP range. Pro, $199 a month: pattern search across all registrable domains (*agent.com, loop-*.com), batch lookup of 500 domains in one call, the newly registered domains feed, and every certificate issued for the hostnames seen on one IP address. Every keyed endpoint is also a tool on the issued.live MCP server at https://issued.live/mcp, on the same plan, for AI assistants. Domains hosted on an IP address Threat researchers pivot from one domain to its server, then from the server to every other domain hosted there. A certificate records the names it covers and nothing about where they are hosted, so crt.sh, Cert Spotter and Merklemap have no IP search. Censys and Shodan scan IP addresses and show what each one serves at scan time, including the names on the certificate it presents. issued.live resolves every name it sees in CT logs and zone files from its own resolvers and keeps each address a name answered with, with no expiry. The reverse IP lookup on Plus returns every domain hosted on an address, with first-seen and last-seen dates. Observations begin in August 2026. curl -sS https://issued.live/api/v1/ip/185.199.108.133 \ -H "Authorization: Bearer $ISSUED_LIVE_KEY" first_seen_from and first_seen_to restrict the list to domains first seen on the address inside a time window, such as the names that moved onto a server this week. /api/v1/range/{cidr} runs the same lookup across up to 256 addresses, covered in find domains in an IP range. On Pro, /api/v1/ip/{ip}/certs returns every certificate issued for the hostnames seen on the address, in issuance order. SSL certificate history for a domain Certificate history is where the tools differ most: crt.sh holds the largest dataset of the free tools, a 68 TB database by Sectigo's count, subject to the availability problems above. Cert Spotter returns unexpired certificates only, so it shows what is valid today. Censys keeps 1 to 12+ months of data depending on the paid tier. issued.live keeps certificates queryable for 32 hours. Pro searches the permanent archive from 9 September 2026 onward, and the daily certificate files are archived permanently from 17 September 2026. For a domain's certificates from before September 2026, use crt.sh. Prices and free limits ToolFree tierPaid fromSearch by crt.shNo account; no published rate limitNo paid tierName, fingerprint, ID, CN, SAN, serial, key ID Cert Spotter100 hostname queries/hour, 10 full-domain/hour$50/month (API), $15/month (monitoring)Domain Censys100 credits/month, account requiredNot publishedCertificates, hosts MerklemapWebsite only; limits not publishedEUR 49/monthDomain, wildcard, edit distance ShodanAccount; filter access not documented$49 once, API $69/monthHosts, certificate fields issued.live1,000 requests/day, no account$39/month; searches from $99/monthDomain, IP, CIDR, certificate, public key, name pattern Sources: crt.sh, the crt.sh mailing list, SSLMate CT Search API, Cert Spotter pricing, Censys free credits, Censys pricing, Merklemap pricing, Shodan plans, Google Transparency Report changelog, and issued.live pricing. Prices change; check the vendor before buying. For bulk domain lists and zone files, the issued.live comparison page covers AllZonefiles.io, Domains-Monitor and WhoisXML API.