cert-transparency

Query crt.sh Certificate Transparency logs to extract deduplicated subdomains.

21|1|Updated Apr 12, 2026

Search Tags:#recon #certificate-transparency #ct-logs #subdomain-enum #crtsh #certificate-audit

Ready to run

npx skills add https://github.com/woohyun212/security-skill --skill cert-transparency

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: cert-transparency
Source: https://github.com/woohyun212/security-skill/tree/main/cert-transparency
Command: npx skills add https://github.com/woohyun212/security-skill --skill cert-transparency

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

CT logs provide public visibility into issued certificates and domain ownership, enabling discovery of subdomains and TLS configurations that are not easily uncovered through DNS alone.

Core Features & Use Cases

Certificate Transparency lookups to surface subdomains and certificates
Deduplicate results and surface a clean attack surface view
Use it for domain auditing, risk assessment, and supplementing other recon sources

Quick Start

Set SECSKILL_TARGET_DOMAIN to the domain you want to investigate and run the skill to fetch and list discovered subdomains.

Frequently Asked Questions about cert-transparency

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find subdomains using certificate transparency logs?▼

Subdomain discovery through certificate transparency logs involves querying public CT log APIs to surface domains associated with issued TLS certificates. This skill queries crt.sh to fetch and deduplicate subdomain records for a target domain, outputting a clean attack surface list.

What is passive reconnaissance and when do I need certificate transparency lookups?▼

Passive reconnaissance gathers target infrastructure data without actively probing the network, relying on third-party sources. Certificate transparency lookups are needed for domain auditing and inventorying TLS assets, uncovering subdomains and certificates not visible through DNS queries alone.

How do I enumerate subdomains from crt.sh output and extract CN/SAN data?▼

Enumerating subdomains from crt.sh involves querying its API and parsing JSON responses to extract Common Name and Subject Alternative Name fields. This skill processes the API output, deduplicates results, and surfaces a clean list of discovered subdomains and certificate data.

Do I need curl and jq to query certificate transparency logs?▼

Yes, curl and jq are required dependencies to query certificate transparency logs via this skill. Curl fetches data from the crt.sh API endpoint while jq parses and extracts the relevant CN and SAN fields from the JSON response for subdomain enumeration.

Are certificate transparency logs effective for finding internal subdomains?▼

Certificate transparency logs are effective for discovering publicly certified subdomains but have limitations uncovering internal infrastructure. CT logs only contain entries for certificates issued by public CAs, so internal subdomains with private or self-signed certificates will not appear in crt.sh query results.

What is the best way to inventory TLS assets for a target domain?▼

Inventorying TLS assets is best done by aggregating issued certificate records from public transparency logs. This skill queries crt.sh to surface all certificates and subdomains for a target domain, providing a deduplicated view for risk assessment and supplementing other recon sources.