Security Tools › PKI & Certificates › Inspect & validate
Certificate Transparency
See every certificate publicly logged for your domain, spot issuers your CAA records do not allow, and check a certificate’s Signed Certificate Timestamps against Chrome’s and Apple’s CT policies. Your browser asks the public logs directly.
- 2 free tools
- Live checks from your browser
- RFC 6962 · CT policies
Inspect & validate
Understand what a certificate, request or revocation list says — and whether it holds together.
CT log search Certificate Transparency · crt.sh · Cert Spotter New
Every publicly trusted TLS certificate is published in Certificate Transparency (CT) logs. Search them for your domain to see every certificate issued for it and its subdomains, and catch the ones you did not ask for: an unexpected CA, a forgotten host, a wildcard, or a certificate that is about to expire without a replacement.
Your browser asks the search service you choose directly; nothing goes through CSMIC. The CAA lookup uses Google Public DNS. CT data is public, so anyone can run the same search for your domain.
Domain
What you expect (optional)
Certificates from any other CA are flagged red. Common identifiers: letsencrypt.org, pki.goog (Google), digicert.com, sectigo.com, godaddy.com, amazon.com, globalsign.com.
- Passed
- Warning
- Failed
- Skipped
SCT checker RFC 6962 · Chrome and Apple CT policies New
Check the Signed Certificate Timestamps (SCTs) embedded in a certificate: which CT logs issued them, whether each log's signature is genuine, and whether the certificate meets the CT policies of Chrome and Apple, which reject certificates without enough valid SCTs.
Signatures are checked in this tab with the logs' public keys from the CT log lists published by Google and Apple, which your browser downloads directly.
The issuing CA's key is part of what each log signed, so include it (your server's chain file has it). From the CT log search with Cert Spotter, "Check SCTs" fills everything in for you.
- Passed
- Warning
- Failed
- Skipped