OSINT › Module 6 › Lesson 2
crt.sh and Certificate Transparency
Search published certificate logs — example.com for literacy, YOUR domain for inventory.
Visual · ct_crtsh
crt.sh searches Certificate Transparency. Original Cyberlium.
Opening
The CA already announced the names. crt.sh is a library card, not a battering ram.
Certificate Transparency is a public ledger of issued certificates. crt.sh is a widely used search UI and JSON helper over those logs. When you ask for %.example.com you are asking which names appeared on certificates, not which hosts you are allowed to attack. Cyberlium lets you see the JSON-or-browser shape with example.com, then tells you to substitute a domain YOU own. Original Cyberlium.
1. What crt.sh is actually searching
A Transparency log records certificates so the public can notice a CA that issued a name nobody expected. crt.sh at https://crt.sh/ is one search surface. Output can be HTML in a browser or JSON when the server is willing. Neither output is a port scan. Neither output authorizes you to touch the hosts named.
SSL Labs at https://www.ssllabs.com/ssltest/ grades TLS configuration of a name YOU choose. Use it on YOUR domain only. openssl s_client shows the certificate THIS host is offered when YOU connect. That is a client view, not a mass scanner.
Command guide
What crt.sh is actually searching
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Search Certificate Transparency logs via crt.sh
Command — copy this
curl -s 'https://crt.sh/?q=%25.example.com&output=json' | python3 -m json.tool | head -60 curl -s 'https://crt.sh/?q=%25.example.com&output=json' | python3 -c "import sys,json; [print(e['name_value']) for e in json.load(sys.stdin)]" | sort -u
═══ WINDOWS ═══
Optional command
PowerShell
Command — copy this
(Invoke-RestMethod 'https://crt.sh/?q=%25.example.com&output=json').name_value | Sort-Object -Unique
2. Read a certificate YOUR client is offered
openssl s_client speaks TLS to a name you typed. For literacy you may connect to example.com:443 and print subject and dates. That is “what did THIS host get,” not “scan the internet.” If the command is missing, write that down. Do not install a random GitHub “ssl scanner” that binds 0.0.0.0.
When you own a domain, repeat the same client view against YOUR name. SSL Labs in a browser is allowed for that same owned name. It is not allowed as a weekend hobby against government sites you do not operate.
3. Substitute YOUR domain or stop
If t12-scope.yaml lists a domain you control, you may change %25.example.com to %25.YOURDOMAIN in the same curl shape. If it does not, keep example.com as a classroom word and do not “practice” on a news site. Public logs do not waive authorization.
Never paste other people's hostnames into a “CT dump” blog. Never hydra names you found.
4. What you ship: a crt.sh literacy note plus YOUR substitution rule
Evidence: crt.sh curl against example.com classified as JSON or browser. openssl s_client subject/dates or “missing.” SSL Labs named for YOUR domain only. chmod 600. No corp mass-enum. SAFE
5. What you record before the next lesson
Date. crt.sh = CT search. example.com literacy. DEMO GATE. NEVER dump sites or nmap. File t12-m06-l02-crtsh.txt.
6. Wrong vs right: strangers vs identifiers YOU own
Worked failure — same OSINT word, opposite target. Right never needs a classmate or a dump site.
Wrong
Scrape unofficial CT dump pages. Run the curl against a corporation you do not own “because logs are public.” Use SSL Labs on a hospital domain for fun.
Right
Literacy query on example.com. Substitute only YOUR domain. openssl on a name you chose honestly. Next: subfinder Amass and assetfinder on YOUR Domain.
Mission: use crt.sh as a library, not a loot crate
1) / STOP if router. 2) Run the crt.sh example.com JSON curl and record JSON vs browser. 3) Write: replace with MY domain or skip. Never mass-enum a stranger. Never nmap to verify names.
Stuck? Ask Cyberlium AI Mentor
If crt.sh times out, ask Mentor how to use the browser UI at https://crt.sh/ — not for a list of “juicy corp subdomains.”
Knowledge Check
APPLY: The crt.sh curl prints “see browser.” You:
Multiple choice
Knowledge Check
APPLY: True or False: openssl s_client against example.com:443 is an authorized literacy command in this lesson.
True or False
Knowledge Check
APPLY: SSL Labs is for:
Multiple choice