Certificate Transparency Lookup (crt.sh): Certs by Domain
Page updated
Price: $0.10 per 1,000 certificates, flat on every Apify plan, no start fee. Free-plan cap: up to 100 certificates per run on the Apify Free plan. Prices checked on 2026-10-17.
The Certificate Transparency Lookup asks crt.sh for the certificates logged for each domain and returns one row per certificate, with its names, issuer, validity dates and a crt.sh link.
It sends one request at a time, caches each answer for the run, and backs off when crt.sh is busy.
Who it is for
Site owners, IT and DevOps teams and agencies who keep track of the certificates issued for domains they manage.
- Keep an inventory of certificates issued for your domains.
- Check which certificate authorities issue certificates for your names.
- Spot certificates that expire soon.
- Confirm that a new certificate was logged after a renewal.
Inputs
| Field | Type | Required | Description |
|---|---|---|---|
| domains | array of strings | Yes | Domains you own or manage, up to 10 per run. |
| includeSubdomains | boolean | No | Also match certificates for names under the domain. Default off. |
| excludeExpired | boolean | No | Only certificates that have not expired. Default on. |
| maxItems | integer | No | Default 500, up to 5,000 certificate rows. |
Example input
{
"domains": [
"example.com"
],
"maxItems": 100
}Example output
[
{
"type": "certificate",
"domain": "example.com",
"certId": 29581277802,
"commonName": "example.com",
"names": [
"*.example.com",
"example.com"
],
"issuerName": "C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3",
"issuerCaId": 413868,
"notBefore": "2026-09-26T22:49:11Z",
"notAfter": "2026-12-25T22:56:35Z",
"serialNumber": "01eee6aabb521d5e14fc315fd9985690",
"expired": false,
"crtShUrl": "https://crt.sh/?id=29581277802"
}
]Price
$0.10 per 1,000 certificates
Free-plan cap: Up to 100 certificates per run on the Apify Free plan
Billing happens on Apify, not on this website.
Limits
- Up to 100 certificates per run on the Apify Free plan.
- At most 10 domains and 5,000 rows per run.
- One request at a time, at least 3 seconds apart. If crt.sh is busy you get a free error row; try again later.
What it does not do
- It does not check the live certificate a server presents. It reads public Certificate Transparency logs.
- It does not return certificates that carry email addresses.
- It does not crawl or contact your servers.
FAQ
What counts as a result?
One logged certificate returned from crt.sh.
Do I pay for errors or domains with no certificates?
No. No-results, invalid-input, error and limit rows are free.
Where does the data come from?
From crt.sh, a free public Certificate Transparency search service run by Sectigo. Lepidata is not affiliated with Sectigo or crt.sh.
Is there a start fee?
No. You pay only the flat price per result.