Cert Spotter API
Free SSLMate Cert Spotter API with no key: search certificate transparency logs for every TLS certificate issued for a domain, with issuer, SANs and validity dates.
Endpoint tested and returned HTTP 200 on 2026-08-21
What is the Cert Spotter API?
The Cert Spotter API from SSLMate is a free, key-free interface to certificate transparency log data. Given a domain it returns the certificates issued for it, each with its SHA-256 fingerprints, DNS names, issuing CA, validity window and revocation status.
Every publicly trusted TLS certificate must be logged to certificate transparency logs before browsers will accept it, which makes those logs a complete public record of who issued what for which name. Cert Spotter indexes them and answers domain queries, so a single request tells you every certificate currently or recently covering a hostname — including ones you did not know about.
That last point is the security use. Unexpected certificates for your domain mean either shadow IT or something worse, and `include_subdomains=true` turns the query into a passive subdomain enumeration that never touches your infrastructure — the CT logs already know. This is reconnaissance without a single packet sent to the target, which is why it is safe to run against domains you do not own. Free unauthenticated use is rate limited per IP and returns a bounded slice of history; SSLMate offers keys for higher limits and complete results, but the anonymous tier answers the common questions perfectly well.
Quick facts
- Base URL
https://api.certspotter.com/v1- Authentication
- No API key needed for basic queries. SSLMate rate limits unauthenticated requests per IP and returns a limited window of results; an API key raises both. Certificate transparency data itself is public.
- Rate limit
- Unauthenticated requests are rate limited per IP and answered with HTTP 429 plus a `Retry-After` header when exceeded. Cache results — certificates do not change once issued.
- Pricing
- Free tier with no account. Paid SSLMate plans add higher limits, full history and monitoring alerts.
- CORS
- Enabled — callable directly from browser JavaScript
- Official docs
- Read the docs
How to use the Cert Spotter API
Every request below was executed against the live API on 2026-08-21, and the response shown is the real body it returned — not an illustration.
1. List certificates issued for a domain
GET https://api.certspotter.com/v1/issuances?domain=iana.org&include_subdomains=false&expand=dns_names&expand=issuer
curl 'https://api.certspotter.com/v1/issuances?domain=iana.org&include_subdomains=false&expand=dns_names&expand=issuer'const res = await fetch("https://api.certspotter.com/v1/issuances?domain=iana.org&include_subdomains=false&expand=dns_names&expand=issuer");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);import requests
res = requests.get("https://api.certspotter.com/v1/issuances?domain=iana.org&include_subdomains=false&expand=dns_names&expand=issuer", timeout=20)
res.raise_for_status()
print(res.json())[
{
"id": "12983149119",
"tbs_sha256": "12c53e43b44dd28faf59eedb1eaa1746669a6c636dde1d5212dc34f7c8a51f45",
"cert_sha256": "146e78ef81434a17a4a787fa41a2e5410e6b677ba030761eaef1f3008f5fae01",
"dns_names": [
"*.iana.org",
"iana.org"
],
"pubkey_sha256": "d56f85824b6ed2ab15b9040c20b574515d9a0ab415ca253b42cbc915a11de18d",
"issuer": {
"friendly_name": "Sectigo",
"pubkey_sha256": "2aa918617e4b60060fed719e9aacdbb4f3c803cc7b052fc16ce21c0177f78f69",
"name": "C=GB, O=Sectigo Limited, CN=Sectigo Public Server Authentication CA OV R36"
},
"not_before": "2025-12-06T00:00:00Z",
"not_after": "2027-01-05T23:59:59Z",
"revoked": false
}
]Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
domain | query | Required | The domain to search for in certificate transparency logs. iana.org |
include_subdomains | query | Optional | Include certificates for subdomains — effectively passive subdomain discovery. true |
expand | query | Optional | Fields to include, repeatable: `dns_names`, `issuer`, `cert`, `revocation`. Without it results are minimal. dns_names |
match_wildcards | query | Optional | Also match wildcard certificates that would cover the domain. true |
after | query | Optional | Return only issuances with an id greater than this, for incremental polling. 12983149119 |
expired | query | Optional | Include certificates that have already expired. false |
Response fields
idstring- Issuance identifier. Pass the highest one back as `after` to poll for new certificates only.
dns_names[]array- Every DNS name the certificate covers, including wildcards. The field that reveals unknown subdomains.
issuer.friendly_name / namestring- The issuing CA, as a short name and as the full distinguished name.
not_before / not_afterstring- Validity window in UTC. `not_after` is your expiry monitoring field.
cert_sha256 / tbs_sha256 / pubkey_sha256string- Fingerprints of the certificate, its signed portion and its public key. `pubkey_sha256` is how you detect key reuse across certificates.
revokedboolean- Revocation status where SSLMate has determined it.
What you can build with the Cert Spotter API
- Monitor for unauthorised certificates issued for your domain
- Enumerate subdomains passively, without probing the target
- Track upcoming certificate expiries across an estate
- Audit which certificate authorities issue for your organisation
- Investigate infrastructure during incident response
Common errors and how to fix them
429 with Retry-After
Unauthenticated rate limit exceeded.
Fix: Honour `Retry-After` and cache results. Certificates are immutable once issued, so repeated identical queries are pure waste.
Minimal results
No `expand` parameters were sent.
Fix: `expand` is repeatable — send `expand=dns_names&expand=issuer` to get the fields most queries actually need.
Fewer results than expected
The free tier returns a bounded window.
Fix: Unauthenticated access is limited in both rate and history. An API key returns complete results if you need exhaustive coverage.
400
The domain was malformed.
Fix: Send a bare hostname without scheme, path or port. `https://example.com/` is rejected.
Cert Spotter API — frequently asked questions
Is the Cert Spotter API free?
Yes for basic queries, with no key or account. SSLMate rate limits anonymous use per IP and caps how much history it returns; paid plans lift both and add monitoring alerts.
Is querying certificates for a domain I do not own legal and safe?
Yes. Certificate transparency logs are a public, append-only record that CAs are required to publish, and querying an index of them sends no traffic to the domain at all. This is passive reconnaissance in the strictest sense.
Can I use this to find subdomains?
Yes, and it is one of the most reliable methods available. Set `include_subdomains=true` and read the `dns_names` arrays — any subdomain that has ever had a public certificate appears, including ones with no DNS record left.
How do I monitor for new certificates continuously?
Poll with the `after` parameter set to the highest `id` you have seen. That returns only issuances newer than your last check, which makes continuous monitoring cheap.
Tools that pair with this API
SSL Certificate Decoder
Decode an SSL/TLS certificate to read its subject, issuer, validity dates, SANs, key size and SHA-256 fingerprint. Runs entirely in your browser.
CSR Decoder
Decode a PKCS#10 certificate signing request to verify the subject, key size and requested SANs before you send it to a certificate authority.
URL Parser
Parse a URL into protocol, host, port, path, query parameters and hash. Handles relative URLs with a base and shows query params in a table. Free and private.
Cert Spotter is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-21; always check the official documentation before relying on this API in production, as terms and limits can change.