Subdomain finder
We list the subdomains that appear in public SSL certificates issued for the domain.
✓ Free, no sign-up
How it works
Every SSL certificate issued by a trusted authority is recorded in public Certificate Transparency logs. We query those logs through crt.sh and extract the names. Only subdomains that ever had a certificate show up; ones that never used HTTPS can't be found this way.
How to use it, step by step
- Enter the main domain.
- We search public SSL certificate logs (Certificate Transparency) for subdomains.
- You'll see each subdomain found and when its certificate was issued.
- Check for old, forgotten or exposed ones.
What it's useful for
- Audit your company's exposed footprint online.
- Discover a domain's services (mail, dashboards, shops).
- Spot old subdomains you should shut down.
FAQ
Is this legal?
Yes. Certificate Transparency logs are public by design, precisely so anyone can audit the certificates that have been issued.
Why does the search sometimes take long or fail?
crt.sh is a heavily used free service and is sometimes overloaded. If it fails, try again in a few minutes.
Where do these subdomains come from?
From public Certificate Transparency logs: every SSL certificate issued is recorded with the names it covers.
Will every subdomain show up?
Only those that had a public SSL certificate. Internal or HTTP-only ones won't appear.
Why should I review my subdomains?
A forgotten subdomain pointing to a cancelled service can be taken over by others. Remove the ones you don't use.
What's a wildcard (*) certificate?
One that covers every first-level subdomain, like *.example.com. It shows up in the list with an asterisk.