Certificate Transparency Checker

Certificate Transparency (CT) makes publicly trusted TLS issuance observable. Certificate authorities submit certificates or precertificates to append-only public logs, allowing domain owners and researchers to notice unexpected names, issuers, and issuance events that might otherwise remain hidden.

A fingerprint lookup asks a narrow and valuable question: does public CT data contain an issuance record for these exact certificate bytes? The SHA-256 fingerprint is computed over the DER-encoded certificate, so two renewals with the same hostname and issuer still have different fingerprints. This is more precise than searching only by domain name.

CT logs reveal issuance, not intent. Anyone monitoring a domain can use them to detect certificates, but the logs do not know whether the domain owner approved the request. They also do not prove that the certificate was installed, is still served, has an uncompromised private key, or chains to a trust anchor accepted by a particular client.

Certificate and precertificate records add another nuance. A precertificate is submitted so CT evidence can be embedded into the final certificate, and a provider may coalesce related log observations into an issuance object. Multiple returned rows can therefore describe separate issuance hashes or provider observations rather than multiple live endpoints.

Hostname comparison is useful when a service name is known. The names parsed from the local certificate can be compared with names returned in CT data, including a wildcard that covers exactly one leftmost label. A mismatch is a review clue, not automatic proof of abuse; provider expansions, parsing, and certificate-versus-precertificate representation can differ.

An exact CT check fits certificate inventory review, incident response, post-issuance verification, and investigation of an unfamiliar certificate. Full chain validation, live TLS inspection, revocation checking, and authorization records remain separate checks.

How to Use This Tool:

Use the exported leaf certificate whose exact public visibility you need to verify, not a private key, CSR, or full chain bundle.

1. Paste a PEM certificate or load PEM, CRT, CER, or DER data in Leaf certificate. Only the first certificate block is parsed as the lookup target.
2. Enter a Reference hostname when you want to compare that service name with both local certificate names and CT-returned names. Clear it to skip that conclusion.
3. Run the check. The certificate is parsed and fingerprinted in the browser, then the 64-character SHA-256 fingerprint is sent to the public CT provider.
4. Read CT evidence first, then inspect the issuance rows for issuer, validity, DNS names, and provider revocation flags.
5. Use UTC for incident handoffs or local time for an operator review. Changing the time display or visible row limit does not change the returned data or posture.
6. Compare the fingerprint with a live TLS endpoint and approved certificate inventory before declaring an issuance expected or unauthorized.

Interpreting Results:

• CT visibility confirmed means at least one row matched the exact fingerprint and the hostname sets did not trigger review.
• Review hostname coverage means local and returned name sets differ, or the reference hostname matches neither the local nor CT name set.
• Review missing public match means the provider returned no row for the exact fingerprint. Confirm the input is the leaf and retry or cross-check another CT source before concluding that no record exists.
• Escalate revoked evidence takes precedence when any returned row carries the provider's revoked flag. Verify current revocation through the issuer's supported method.

Technical Details:

The browser decodes PEM or base64 DER into one X.509 certificate, reads its subject and DNS Subject Alternative Names, and hashes the exact DER bytes with SHA-256. The public lookup receives the fingerprint rather than the certificate body.

Transformation Core:

Lookup Core:

The lookup uses the Cert Spotter CT Search API and requests issuance identifiers, certificate and TBSCertificate hashes, issuer details, DNS names, validity dates, revocation information, and problem-reporting guidance. Returned rows are normalized before counts are calculated. The number of unique issuances uses the TBSCertificate hash when available, falling back to the provider row identifier.

Local DNS names and CT-returned DNS names are deduplicated and sorted. The comparison reports local-only and CT-only names by exact normalized string. The optional reference hostname is evaluated separately: an exact name wins, while a wildcard matches only one label immediately below its suffix.

Rule Core:

The visible row limit is constrained from 5 through 30 and affects only the displayed ledger. All returned rows remain in the canonical result used for counts, name comparisons, issuer totals, and exports. UTC versus local time changes formatting only.

Privacy and Accuracy Notes:

The certificate is parsed and hashed in the browser. Only its SHA-256 fingerprint is sent to the public CT provider, with browser credentials omitted. Certificate text and loaded file contents are not placed in the shareable URL.

• A certificate is public material in ordinary Web PKI use, but never paste a private key or confidential internal certificate unless disclosure is acceptable.
• The provider can be unavailable or rate-limited, and newly logged data may not be immediately visible. A missing row is not definitive proof of absence.
• Provider revocation evidence can be stale or incomplete. Confirm with current OCSP, CRL, or issuer guidance before making a high-impact decision.
• CT visibility does not validate the certificate chain, hostname on a live endpoint, browser CT policy, current deployment, or issuance authorization.

References:

• RFC 9162: Certificate Transparency Version 2.0, IETF, December 2021.
• SSLMate CT Search API v1, SSLMate.
• How to search certificate transparency logs for a domain, Simplified Guide.
• How to save a TLS server certificate using OpenSSL, Simplified Guide.