Subdomain certificate monitor: crt.sh certificate-transparency logs as JSON
A pay-per-result monitor for certificate-transparency logs: discover subdomains, certificate issuers, and certificate validity dates for any domain via crt.sh, one flat record per certificate for CSV, Excel, or JSON export.
What the API returns
Each run writes one record per company to the default dataset. Field names below are the actual dataset schema of the crt.sh Cert Monitor — Subdomain & SSL Cert Discovery actor.
| Field | Contents |
|---|---|
domain | Queried parent domain |
subdomain | Subdomain(s) found in the certificate logs |
issuer | Certificate issuer |
notBefore / notAfter | Certificate validity window |
entryTimestamp | When the certificate was logged |
crtId | crt.sh certificate ID for the original log entry |
Official source, no API key needed
crt.sh (certificate-transparency log search, operated by Sectigo). crt.sh aggregates public certificate-transparency logs and publishes them openly. The actor queries it keyless, so every run sees the current CT state — newly issued certificates surface as new subdomains and issuer entries.
Pricing
$0.00125 per result found (volume tiers down to $0.0009), plus $0.05 per actor start. Pay-per-event pricing: pay for results, not for a subscription.
crt.sh Cert Monitor — Subdomain & SSL Cert Discovery on the Apify Store
FAQ
How do I monitor a domain for new subdomains?
Every TLS certificate issued for a subdomain is logged in public certificate-transparency logs, searchable via crt.sh. This actor queries those logs for your domain and returns one flat record per certificate: subdomain, issuer, validity dates, log timestamp, and the crt.sh cert ID. Schedule it to catch newly issued subdomains.
How is the actor priced?
Pay per event: $0.00125 per certificate-transparency record (tiering down to $0.0009 at volume) plus $0.05 per run start. No subscription.
What is it used for?
Attack-surface discovery and brand monitoring: the CT logs expose subdomains, issuing CAs, and certificate lifetimes before they appear anywhere else. The flat one-record-per-cert output exports straight to CSV, Excel, or JSON.