# Certificate Transparency Enumeration

> Enumerate subdomains and infrastructure by querying Certificate Transparency logs, leveraging publicly recorded TLS certificates to map attack surface during recon.

- **URL:** https://hackindex.io/services/web/reconnaissance/certificate-transparency-enumeration
- **Path:** HTTP/HTTPS > Reconnaissance
- **Up:** [Reconnaissance](https://hackindex.io/services/web/reconnaissance.md)
- **Published:** 2026-03-28
- **Updated:** 2026-07-10

Certificate transparency logs record every TLS certificate issued by public CAs. Every subdomain that has ever had a certificate is visible: including internal hostnames, staging environments, and short-lived test domains. CT enumeration is passive, generates no target traffic, and often surfaces subdomains that wordlist bruteforce misses entirely.

Feed results into [subdomain bruteforce](https://hackindex.io/services/web/reconnaissance/subdomain-bruteforce) as seed names and into [virtual host enumeration](https://hackindex.io/services/web/enumeration/virtual-host-enumeration) when multiple names resolve to the same IP.

Key CT enumeration sources and tools:

- **crt.sh** for fast JSON API queries against aggregated CT logs
- **amass** for multi-source passive enumeration including CT, DNS, and APIs
- **openssl** for extracting SANs directly from live TLS certificates
- **httpx** for probing discovered hostnames and filtering live targets

## crt.sh Query

crt.sh is the fastest CT log search. Query it via the API for a domain and get all certificates including wildcards and subdomains:

```bash
curl -sk "https://crt.sh/?q=%25.$DOMAIN&output=json" | python3 -c "import sys,json; data=json.load(sys.stdin); [print(e['name_value']) for e in data]" | sort -u
# dev.example.com
# api.example.com
# staging.example.com
# *.internal.example.com
# mail.example.com
```

The `%25.` prefix is a SQL LIKE wildcard that matches all subdomains. Wildcard certificates (`*.example.com`) confirm wildcard DNS is likely in use. Internal-looking names like `internal`, `corp`, `intranet`, or `dev` are high-priority targets for virtual host enumeration.

Clean the output to a simple hostname list:

```bash
curl -sk "https://crt.sh/?q=%25.$DOMAIN&output=json" | python3 -c "import sys,json; data=json.load(sys.stdin); [print(e['name_value'].replace('*.','')) for e in data]" | grep -v '@' | sort -u > ct_subdomains.txt && wc -l ct_subdomains.txt
# 47 ct_subdomains.txt
```

## amass Passive CT Enumeration

amass queries multiple CT log sources and passive DNS databases simultaneously. Slower than crt.sh but more comprehensive:

```bash
amass enum -passive -d $DOMAIN -o amass_ct.txt
```

```bash
amass enum -passive -d $DOMAIN -src -o amass_ct_sources.txt
# CertSpotter  dev.example.com
# crt.sh       api.example.com
# DNSDB        staging.example.com
```

The `-src` flag shows which source found each hostname. Subdomains found only in CT logs but not in DNS often indicate decommissioned infrastructure that may still be reachable.

## Extract SANs from Live Certificates

When you already have an IP or hostname, pull the live certificate and extract all Subject Alternative Names. These often reveal additional hostnames not in DNS:

```bash
openssl s_client -connect $DOMAIN:443 -servername $DOMAIN </dev/null 2>/dev/null | openssl x509 -noout -ext subjectAltName
# X509v3 Subject Alternative Name:
#     DNS:example.com, DNS:www.example.com, DNS:api.example.com, DNS:internal.corp.example.com
```

```bash
openssl s_client -connect $TARGET_IP:443 -servername $DOMAIN </dev/null 2>/dev/null | openssl x509 -noout -ext subjectAltName | grep -oP '(?<=DNS:)[^,]+'
# example.com
# www.example.com
# api.example.com
# internal.corp.example.com
```

Internal-looking names in the SAN confirm the server is used internally as well as externally. These names are candidates for [virtual host enumeration](https://hackindex.io/services/web/enumeration/virtual-host-enumeration) even if they don't resolve in public DNS.

## Certificate Transparency Subdomain Enumeration with httpx

Resolve and probe all discovered names in one pass to identify which are live and what they serve:

```bash
httpx -l ct_subdomains.txt -status-code -title -tech-detect -o ct_live.txt
# https://dev.example.com [200] [Dev Portal] [nginx,PHP]
# https://staging.example.com [401] [Staging] [Apache]
# https://api.example.com [200] [API] [nginx]
```

Staging and dev environments that return 401 are worth credential testing from other sources in scope. Any environment with a different tech stack than the main domain is independently enumerable and may have lower security maturity.

Related

## References

- [crt.sh](https://crt.sh/) - Certificate transparency log search with JSON API output
- [amass](https://github.com/owasp-amass/amass) - Multi-source passive subdomain enumeration including CT logs
- [httpx: ProjectDiscovery](https://docs.projectdiscovery.io/opensource/httpx) - Fast HTTP probing for resolving and fingerprinting discovered hostnames