Certificate Transparency Log API

The Certificate Transparency Log API enables proactive monitoring and auditing of SSL/TLS certificates issued for domain names. It helps verify proper issuance, spot misuse, and fortify web security by safeguarding online interactions and maintaining the trustworthiness of digital environments. The Certificate Transparency (CT) Log is a public, append-only ledger of all SSL/TLS certificates issued by trusted Certificate Authorities (CAs). Developed by Google, its primary purpose is to enhance internet security by making the process of certificate issuance transparent and publicly auditable. This transparency allows domain owners and the broader community to monitor and verify certificates, quickly detect any misissued or malicious certificates, and prevent potential security threats like man-in-the-middle attacks.

Our Certificate Transparency Log Replica hosted at https://crt.edgewatch.net/ provides an independent and readily accessible copy of the CT logs. By offering this replica, we enable organizations, security researchers, and individuals to proactively monitor and audit SSL/TLS certificates related to their domains. This service helps verify proper certificate issuance and swiftly identify any misuse, thereby fortifying web security and maintaining the trustworthiness of digital environments. Our API facilitates efficient querying and retrieval of certificate information, empowering users to safeguard their online interactions.

Base URL:

https://crt.edgewatch.net

Quick start

1) (Optional but recommended) Obtain a JWT using your client credentials

curl -s https://crt.edgewatch.net/auth/token/ \
  -H "X-Client-Id: <client-id>" \
  -H "X-Client-Secret: <client-secret>"

2) Search for certificates (exact match)

TOKEN="<jwt>"
curl -s "https://crt.edgewatch.net/certificates/search/?dns_name=example.com&search_mode=exact&limit=10" \
  -H "Authorization: Bearer $TOKEN" | jq

You may also authenticate every request with X-Client-Id and X-Client-Secret headers if JWT is not convenient for your workflow.

Authentication & rate limits

• Unauthenticated requests are intentionally throttled and suitable only for light, manual testing.
• Authenticated requests accept either:
  • Authorization: Bearer <JWT> (recommended), or
    X-Client-Id and X-Client-Secret headers.
• Token refresh: exchange a refresh token at GET /auth/refresh/ using header X-Refresh-Token.
• HTTP 429 indicates you exceeded burst/usage limits. Back off with exponential retries.
  

Conventions

• Dates accept YYYY-MM-DD and (where applicable) timestamps in UTC ISO‑8601.
• Unless stated otherwise, endpoints return JSON.
• Most list endpoints take a limit parameter. Use restrictive filters (domain, date ranges) for best performance.
  

Endpoint overview

Search certificates

GET /certificates/search/

Search for certificates by DNS name with flexible match modes.

Query parameters

Example

curl -s "https://crt.edgewatch.net/certificates/search/?dns_name=example.com&search_mode=exact&limit=10" \
  -H "Authorization: Bearer <jwt>"

Response (truncated)

{
  "count": 10,
  "certificates": [
    {
      "url": "https://ct.googleapis.com/logs/argon2024/",
      "cert_index": "123456789",
      "url_plus_index": "https://ct.googleapis.com/logs/argon2024/|123456789",
      "not_before": "2024-01-01T00:00:00Z",
      "not_after": "2025-01-01T00:00:00Z",
      "all_dns_names": "example.com www.example.com api.example.com",
      "dns_name_count": 3,
      "wildcard_count": 0
    }
  ],
  "filters_applied": {"dns_name": "example.com", "search_mode": "exact"},
  "performance": {"cached": false, "execution_time": 0.25, "query_time_seconds": 0.23}
}

Performance tips

• Prefer exact when you know the precise name.
• prefix is ideal for brand monitoring (e.g., edgewatch).
• suffix is ideal for subdomain discovery (e.g., example.com).
• contains is flexible but slower.
  

Domain monitor

GET /certificates/domain-monitor/{domain}/

Returns a categorized snapshot for a domain (active, expired, expiring soon), with optional date filtering.

Path parameters

Query parameters

Example

curl -s "https://crt.edgewatch.net/certificates/domain-monitor/example.com/?exact=true" \
  -H "Authorization: Bearer <jwt>"

Subdomain enumeration

GET /certificates/subdomains/{domain}/

Discovers subdomains observed in CT for a given base domain.

Path parameters

Query parameters

Example

curl -s "https://crt.edgewatch.net/certificates/subdomains/example.com/?limit=2000" \
  -H "Authorization: Bearer <jwt>"

Expiring soon

GET /certificates/expiring-soon/

Find certificates that will expire within the specified horizon.

Query parameters

Example

curl -s "https://crt.edgewatch.net/certificates/expiring-soon/?days_ahead=14&domain_name=example.com" \
  -H "Authorization: Bearer <jwt>"

Expired

GET /certificates/expired/

List certificates that have already expired within the requested window.

Query parameters

Example

curl -s "https://crt.edgewatch.net/certificates/expired/?from_date=2024-11-01&to_date=2024-11-11&domain_name=example.com" \
  -H "Authorization: Bearer <jwt>"

Wildcards

GET /certificates/wildcards/

Retrieve certificates that include wildcard names (e.g., *.example.com).

Query parameters

Recently updated

GET /certificates/recently-updated/

Certificates most recently observed or updated in the CT backend.

Query parameters

Identify domains with a high number of distinct certificates (useful for inventory and anomaly detection).

Multiple certificates per domain

GET /certificates/multiple-certs-domains/

Query parameters

Oldest active

GET /certificates/oldest-active/

Surface the oldest yet still valid certificates.

Query parameters

Long validity

GET /certificates/long-validity/

Locate certificates with unusually long validity windows (commonly historical, pre‑2020).

Query parameters

Frequent chain changes

GET /certificates/frequent-chain-changes/

Detect potentially suspicious frequent re‑issuance by tracking chain hash changes. This query is expensive. Restrict the date range and filter by domain when possible.

Query parameters

KPIs & stats

Home stats

GET /api/home-stats/ – Cached summary for landing dashboards.

Certificate counts

GET /api/certificate-counts/ – Counts split by active/expired.

Active count

GET /certificates/active-count/ – Total active certificates.

45‑day stats

GET /certificates/stats/ – Rolling daily counts of new, expired, issued.

Health & performance endpoints

• GET /health/ – Service and dependency health. (No auth.)
• GET /performance/ – Cache hit ratio, slow query counts, timings.
• GET /ping/ – Simple liveness probe. (No auth.)
  

Data model

Certificate object (common fields)

Envelope (typical list response)

{
"count": 123,
"certificates": [ /* … */ ],
"filters_applied": { /* echo of your filters */ },
"performance": {
"cached": true,
"execution_time": 0.08,
"query_time_seconds": 0.07
},
"note": "Optional informational message"
}

Performance guidance

• Match mode: exact and prefix leverage indexes; contains is most expensive
• Date windows: Prefer short, recent windows (7–30 days). Historical digs should be sliced.
• Caching: Responses are cached with a short TTL. Use skip_cache=true only when freshness is critical.
• Filtering: Add domain/domain_name filters whenever possible.
• Limits: Start small during development; increase gradually.
  

Expected latencies (indicative):

Errors & troubleshooting

Debug tips:

• Echo the server’s filters_applied and performance blocks to understand what ran.
• Narrow from_date/to_date and add domain/domain_name filters.
• Inspect whether the response was a cache miss (first call) or cache hit (subsequent call).
  

Security & compliance

• HTTPS‑only, JWT‑based auth with refresh tokens.
• Request throttling and per‑token rate limits.
• Optional service‑to‑service authentication via client headers.
• Usage is tracked for fairness; abuse is automatically curtailed.
  

SDK‑style snippets

Python (requests)

import requests

BASE = "https://crt.edgewatch.net"
headers = {"Authorization": "Bearer <jwt>"}

r = requests.get(f"{BASE}/certificates/search/", params={
"dns_name": "example.com",
"search_mode": "exact",
"limit": 10,
}, headers=headers)
print(r.json())

Node.js (fetch)

const BASE = 'https://crt.edgewatch.net';
const headers = { Authorization: 'Bearer <jwt>' };

async function search() {
  const url = new URL('/certificates/search/', BASE);
  url.searchParams.set('dns_name', 'example.com');
  url.searchParams.set('search_mode', 'exact');
  url.searchParams.set('limit', '10');
  const res = await fetch(url, { headers });
  const data = await res.json();
  console.log(data);
}
search();