Certificate-Transparency Subdomain Finder

Discover a domain's subdomains from public certificate-transparency (CT) logs — the append-only record of every TLS certificate issued. Because subdomains usually get their own certificates, those logs are a rich, passive source for mapping a domain's public footprint. For each name you'll see the issuer and validity window where available. Use it to understand and reduce your own attack surface.

What this subdomain finder shows

  • Subdomains under the domain that have appeared in a logged certificate — often revealing staging, admin, API, VPN, and internal-facing hosts.
  • Issuer — which certificate authority signed each name's certificate.
  • Validity — the earliest start and latest expiry seen across that name's certificates.

This is passive reconnaissance: it reads already-public certificate logs and never scans, probes, or connects to the target's servers. Use it on domains you own or are authorized to assess.

Find subdomains

Enter a domain like example.com (no http://, no path).


Frequently asked questions

What is certificate transparency?
A public, append-only log of every TLS certificate issued by participating authorities. Because each subdomain typically gets its own certificate, searching the logs reveals subdomains without ever touching the target's systems.
Why would I want to find my own subdomains?
Forgotten staging, admin, or test hosts are a classic way in for attackers. Seeing everything that has a public certificate helps you find and secure or retire exposed hosts you may have forgotten.
Is this the same as scanning a domain?
No. It only reads public certificate logs — it sends nothing to the target's servers, so it is entirely passive.
Why might a subdomain be missing?
Only names that have appeared in a logged certificate show up. A subdomain served without its own public certificate, or one behind a wildcard, may not be listed individually.
Why did the lookup come back empty or slow?
Certificate-transparency sources are free shared services and can occasionally be slow or briefly unavailable. If that happens, a note explains it and you can try again shortly.