Certificate Transparency

Read the public Certificate Transparency logs from a workflow. Every publicly trusted certificate on the web has to be published to these append-only logs before a browser will accept it, so they are the one place that can answer what certificates exist for a name and who issued them without asking the certificate authority. Browse the logs Chrome itself trusts and who runs them, work out which one could hold a certificate from its expiry date, read a log's size and root hash, list the CA roots it accepts, and read its newest entries with every certificate decoded into its domain names, issuer and validity - or scan for the ones covering a domain you own, which is how a workflow catches a certificate nobody meant to issue. Ask a log to prove an entry is really in it, or that it has only ever appended, and the proof is checked for you. Works with both the original RFC 6962 logs and the newer tiled ones. Every action reads: nothing here changes anything. No account or API key required.

Actions

Action	What it does
Find certificates for a domain in a log	Scan the newest stretch of a log for certificates covering a domain, optionally including its subdomains.
Find logs for a certificate expiry date	Given the day a certificate expires, say which logs could hold it.
Get a log	Read everything the published list says about one log: who runs it and how to contact them, its URL, its public key, its state and when it entered it, how long it may take to include a certificate it accepted, and the certificate expiry window it covers.
Get a log's newest entries	Read the certificates a log has just taken, newest first, without working out any index: it reads the log's current size and takes the entries at the end of it.
Get a log's tree head	Read how big a log is right now and the root hash that commits to everything in it.
Get a tiled log's checkpoint	Read a tiled log's checkpoint in full: the signed note it publishes in place of a signed tree head, with its origin line, its size, its root hash and every signature on it - including the independent witnesses that co-sign it, which is what makes a tiled log's word harder to take back.
Get an entry with its proof	Read the entry at a given position and prove it is in the log, in one call.
Get an issuer certificate	Fetch one of the CA certificates a tiled log stores, by its SHA-256 fingerprint, decoded and also as PEM ready to paste into another tool.
Get entries from a log	Read a range of a log's entries and decode the certificate in each one: the domain names it covers, who issued it, when it was issued and when it expires, its fingerprint, and the signed timestamps its CA embedded.
List Certificate Transparency logs	List the Certificate Transparency logs, from the same published list Chrome itself uses.
List log operators	List the organisations that run Certificate Transparency logs - Google, Cloudflare, Let's Encrypt, DigiCert, Sectigo and the rest - with how many logs each runs, how many of those are usable, how they split between the two log formats, and the contact addresses they publish.
List the roots a log accepts	List the CA root certificates a log will accept chains up to, each decoded into its subject, its issuer, its validity dates and its SHA-256 fingerprint.
Prove a log has only appended	Ask a log to prove that everything it published at an earlier size is still there, unchanged, in the log as it is now.
Prove an entry is in a log	Ask a log to prove that an entry really is in it, and check the proof.
Summarize the log list	Read which version of the published Certificate Transparency log list is current, when it was published, and what it holds: how many logs there are in each state, how they split between the RFC 6962 and tiled formats, how many operators run them, and the range of certificate expiry dates the logs cover between them.

Find certificates for a domain in a log

Scan the newest stretch of a log for certificates covering a domain, optionally including its subdomains. This is how a workflow catches a certificate being issued for a name it owns - the thing Certificate Transparency exists to make visible. Narrow it further by issuing CA, by certificate or precertificate, and by the moment the log accepted it. A log has no search of its own, so this reads entries from the end backwards and filters them here; how far back it looks is up to you, and it says how many it read. No account or API key required.

Inputs

LoglogtextRequired: Which Certificate Transparency log to read. The dropdown lists the usable and qualified logs with the certificate expiry window each one covers, and stores the log's id rather than its name so a workflow keeps working when a log is renamed. Typed by hand it also takes a log id, a description as the log list writes it, or the log's URL.
DomaindomaintextRequired: The domain to look for, such as example.com. Matched against every name on the certificate; a wildcard certificate matches its own parent domain when subdomains are included. A name read off an earlier step works as it comes: a leading '*.' is dropped, since searching for '*.example.com' means the same thing as searching for 'example.com'.
Include subdomainsinclude_subdomainstrue/false: Also match names under the domain, so example.com finds shop.example.com and *.example.com.Default: false.
Issued byissuertext: Only certificates whose issuer contains this text, matched without regard to case. Use it to spot a certificate from a CA you do not use.
Entry kindentry_typetext: Whether to count certificates, precertificates, or both. A CA logs a precertificate before it issues, so the same certificate usually appears as both.One of: any (Both kinds), x509_entry (Certificates only), precert_entry (Precertificates only). Default: any.
Only entries logged afterlogged_afterdate and time: Only entries the log accepted after this moment. Leave empty for everything in the scanned range. Set it to the last run's finish time to see only what is new.
How many entries to scanscan_entriesnumber: How far back from the end of the log to look. Bigger means more requests and a slower step; the result always says how many entries were actually read and the oldest moment reached.From 1 to 500. Default: 100.

Outputs

certificate_countnumber: How many of the returned entries are certificates
distinct_issuerslist: Which CAs issued them, most first
dns_nameslist: Every DNS name across the returned entries, deduplicated
domaintext: The domain looked for, normalised
entries_scannednumber: How many entries were actually read
include_subdomainstrue/false: Whether names under it were matched too
logobject: Which log answered this
match_countnumber: How many matched
matcheslist: The matching entries, newest first
newest_scanned_attext: The newest moment the scan reached
oldest_scanned_attext: The oldest moment the scan reached - how far back this answer actually covers
precertificate_countnumber: How many are precertificates
scan_requestednumber: How many were asked to be read
scanned_from_indexnumber: The entry the scan started at
tree_sizenumber: How big the log was when this ran
unreadable_entriesnumber: How many could not be decoded

Example output

{
  "certificate_count": 1,
  "distinct_issuers": [
    {
      "count": 1,
      "issuer": "E7"
    }
  ],
  "dns_names": [
    "shop.example.com",
    "www.shop.example.com"
  ],
  "domain": "example.com",
  "entries_scanned": 100,
  "include_subdomains": true,
  "log": {
    "description": "Google 'Argon2026h2' log",
    "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=",
    "log_type": "rfc6962",
    "operator": "Google",
    "state": "usable",
    "url": "https://ct.googleapis.com/logs/us1/argon2026h2/"
  },
  "match_count": 1,
  "matches": [
    {
      "certificate": {
        "der_bytes": 1503,
        "dns_name_count": 2,
        "dns_names": [
          "shop.example.com",
          "www.shop.example.com"
        ],
        "embedded_sct_count": 2,
        "embedded_scts": [
          {
            "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=",
            "log_id_hex": "d76d7d10d1a7f577c2c7e95fd700bff982c9335a65e1d0b3017317c0c8c56977",
            "logged_at": "2026-08-27T20:22:12.042Z",
            "timestamp": 1787862132042
          },
          {
            "log_id": "3e+CLnzhZlDPAHiy21ZK1AYxbb1JDU5Xz6y7tOSaOF0=",
            "log_id_hex": "ddef822e7ce16650cf0078b2db564ad406316dbd490d4e57cfacbbb4e49a385d",
            "logged_at": "2026-08-27T20:22:10.118Z",
            "timestamp": 1787862130118
          }
        ],
        "fingerprint_sha256": "4973b48cf244e4981d43ff0485c347d50a22f0b827f9d0c96f9233a9e7646bf5",
        "fingerprint_sha256_base64": "SXO0jPJE5JgdQ/8EhcNH1Qoi8Lgn+dDJb5Izqedka/U=",
        "ip_addresses": [],
        "is_ca": false,
        "is_precertificate": false,
        "issuer": "C=US, O=Let's Encrypt, CN=E7",
        "issuer_country": "US",
        "issuer_name": "E7",
        "issuer_organization": "Let's Encrypt",
        "not_after": "2026-11-25T19:23:40Z",
        "not_before": "2026-08-27T19:23:41Z",
        "serial_number": "05eebb1d605d88f2cefb2343c4c80009817b",
        "subject": "CN=shop.example.com",
        "subject_common_name": "shop.example.com",
        "subject_organization": "",
        "validity_days": 90.0,
        "version": 3
      },
      "chain_fingerprints": [
        "a2372d06431e9716365eeed47ec020351497d182fcc038e457e58168a03cac07",
        "349dfa4058c5e263123b398ae795573c4e1313c83fe68f93556cd5e8031b3c7d"
      ],
      "chain_length": 2,
      "entry_type": "x509_entry",
      "index": 2750089397,
      "issuer_key_hash": null,
      "leaf_hash": "Ovw+MVXYy6mDh1kBu6RhbAyIYq5DBbfnzY3Y5Ki5g2M=",
      "leaf_hash_hex": "3afc3e3155d8cba983875901bba4616c0c8862ae4305b7e7cd8dd8e4a8b98363",
      "logged_at": "2026-08-27T20:22:12.042Z",
      "timestamp": 1787862132042
    }
  ],
  "newest_scanned_at": "2026-08-27T20:22:12.042Z",
  "oldest_scanned_at": "2026-08-27T20:20:44.118Z",
  "precertificate_count": 0,
  "scan_requested": 100,
  "scanned_from_index": 2750089298,
  "tree_size": 2750089398,
  "unreadable_entries": 0
}

Find logs for a certificate expiry date

Given the day a certificate expires, say which logs could hold it. Certificate Transparency logs are sharded by year - Argon2026h2 only takes certificates expiring in the second half of 2026 - so asking the wrong shard returns nothing, correctly and misleadingly. Pick the expiry date off a certificate and this answers which logs to look in, grouped by operator so a check can be spread across several. No account or API key required.

Inputs

Certificate expiry dateexpires_ondateRequired: The day the certificate expires - its 'not after' date. A full timestamp read off an earlier step works too; only the date is used.
Statesstatestext: Only logs in these states. A log's state is what says whether it is worth reading: browsers only trust certificates logged to a usable one, a retired log is frozen, and a rejected one failed qualification and proves nothing. Choose none to see every log.One or more of: usable (Usable - trusted, and taking new certificates), qualified (Qualified - passed its tests, being included), pending (Pending - has asked to be included), readonly (Read-only - frozen, but still readable), retired (Retired - no longer trusted for new certificates), rejected (Rejected - failed qualification), unknown (Unknown - the list gives no state (test and mirror logs)).
Log softwarelog_typetext: Only logs of this kind. RFC 6962 logs answer the original JSON API and are the only ones that serve proofs; tiled logs publish static files instead. Reading tree heads and entries works on either.One of: any (Either kind), rfc6962 (RFC 6962 - the original API, and serves proofs), tiled (Tiled (static-ct-api) - the newer, static format). Default: any.
How many to returnlimitnumber: How many logs to return. The list holds about 120 logs in total, so the default of 50 covers every usable one.From 1 to 250. Default: 50.

Outputs

expires_ontext: The date asked about, as YYYY-MM-DD
logslist: The logs that accept that expiry date
match_countnumber: How many matched before the limit
operator_countnumber: How many operators that is
operatorslist: The operators running those logs
returnednumber: How many logs came back
source_urltext: The Certificate Transparency project page
states_filteredlist: The states this was narrowed to

Example output

{
  "expires_on": "2026-11-25",
  "logs": [
    {
      "accepts_expiry_from": "2026-07-01T00:00:00Z",
      "accepts_expiry_until": "2027-01-01T00:00:00Z",
      "description": "Google 'Argon2026h2' log",
      "final_tree_size": null,
      "is_usable": true,
      "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=",
      "log_id_hex": "d76d7d10d1a7f577c2c7e95fd700bff982c9335a65e1d0b3017317c0c8c56977",
      "log_type": "rfc6962",
      "maximum_merge_delay_seconds": 86400,
      "monitoring_url": "https://ct.googleapis.com/logs/us1/argon2026h2/",
      "operator": "Google",
      "operator_emails": [
        "google-ct-logs@googlegroups.com"
      ],
      "public_key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKjpni/66DIYrSlGK6Rf+e6F2c/28ZUvDJ79N81+gyimAESAyeNZ++TRgjHWg9TVQnKHTSU0T1TtqDupFnSQTIg==",
      "state": "usable",
      "state_since": "2024-09-30T22:19:27Z",
      "submission_url": "https://ct.googleapis.com/logs/us1/argon2026h2/",
      "url": "https://ct.googleapis.com/logs/us1/argon2026h2/"
    },
    {
      "accepts_expiry_from": "2026-01-01T00:00:00Z",
      "accepts_expiry_until": "2027-01-01T00:00:00Z",
      "description": "Cloudflare 'Nimbus2026'",
      "final_tree_size": null,
      "is_usable": true,
      "log_id": "3e+CLnzhZlDPAHiy21ZK1AYxbb1JDU5Xz6y7tOSaOF0=",
      "log_id_hex": "ddef822e7ce16650cf0078b2db564ad406316dbd490d4e57cfacbbb4e49a385d",
      "log_type": "rfc6962",
      "maximum_merge_delay_seconds": 86400,
      "monitoring_url": "https://ct.cloudflare.com/logs/nimbus2026/",
      "operator": "Cloudflare",
      "operator_emails": [
        "ct-logs@cloudflare.com"
      ],
      "public_key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE",
      "state": "usable",
      "state_since": "2023-05-23T20:00:00Z",
      "submission_url": "https://ct.cloudflare.com/logs/nimbus2026/",
      "url": "https://ct.cloudflare.com/logs/nimbus2026/"
    }
  ],
  "match_count": 16,
  "operator_count": 8,
  "operators": [
    "Cloudflare",
    "Google"
  ],
  "returned": 2,
  "source_url": "https://certificate.transparency.dev",
  "states_filtered": [
    "usable",
    "qualified"
  ]
}

Get a log

Read everything the published list says about one log: who runs it and how to contact them, its URL, its public key, its state and when it entered it, how long it may take to include a certificate it accepted, and the certificate expiry window it covers. Takes a log id, a description or a URL, so a log named by some other tool can be looked up here. No account or API key required.

Inputs

LoglogtextRequired: Which log to read. This dropdown offers every log the list names, retired and rejected ones included, with the state on each label - a retired log still holds everything it ever held. Typed by hand it takes a log id, a description, or the log's URL.

Outputs

accepts_expiry_fromtext: The first certificate expiry date this log accepts. Logs are sharded by year, so this is what decides whether a certificate could be in it at all
accepts_expiry_untiltext: The first expiry date it no longer accepts (exclusive)
descriptiontext: The log's name, e.g. "Google 'Argon2026h2' log"
final_tree_sizenumber: For a read-only log, the size it was frozen at; else null
is_usabletrue/false: Whether it is usable or qualified, i.e. worth reading
log_idtext: The log's id: the SHA-256 of its public key, in base64
log_id_hextext: The same id in hex
log_typetext: 'rfc6962' or 'tiled' (static-ct-api)
maximum_merge_delay_secondsnumber: How long the log may take to include a certificate it accepted
monitoring_urltext: The prefix a tiled log's checkpoint, tiles and issuers are read from; the same as the URL for an RFC 6962 log
operatortext: The organisation running it, e.g. 'Let's Encrypt'
operator_emailslist: Contact addresses the operator publishes
public_keytext: The log's public key, base64 DER, for verifying its signatures
source_urltext: The Certificate Transparency project page
statetext: 'usable', 'qualified', 'pending', 'readonly', 'retired' or 'rejected'
state_sincetext: When it entered that state, ISO 8601
submission_urltext: The prefix a CA submits certificates to
urltext: Where the log is reached

Example output

{
  "accepts_expiry_from": "2026-07-01T00:00:00Z",
  "accepts_expiry_until": "2027-01-01T00:00:00Z",
  "description": "Google 'Argon2026h2' log",
  "final_tree_size": null,
  "is_usable": true,
  "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=",
  "log_id_hex": "d76d7d10d1a7f577c2c7e95fd700bff982c9335a65e1d0b3017317c0c8c56977",
  "log_type": "rfc6962",
  "maximum_merge_delay_seconds": 86400,
  "monitoring_url": "https://ct.googleapis.com/logs/us1/argon2026h2/",
  "operator": "Google",
  "operator_emails": [
    "google-ct-logs@googlegroups.com"
  ],
  "public_key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKjpni/66DIYrSlGK6Rf+e6F2c/28ZUvDJ79N81+gyimAESAyeNZ++TRgjHWg9TVQnKHTSU0T1TtqDupFnSQTIg==",
  "source_url": "https://certificate.transparency.dev",
  "state": "usable",
  "state_since": "2024-09-30T22:19:27Z",
  "submission_url": "https://ct.googleapis.com/logs/us1/argon2026h2/",
  "url": "https://ct.googleapis.com/logs/us1/argon2026h2/"
}

Get a log's newest entries

Read the certificates a log has just taken, newest first, without working out any index: it reads the log's current size and takes the entries at the end of it. This is the live view of what the web PKI is issuing right now - every certificate any CA issues reaches a log within hours. Each entry is decoded into its domain names, issuer and validity. Works on either kind of log. No account or API key required.

Inputs

LoglogtextRequired: Which Certificate Transparency log to read. The dropdown lists the usable and qualified logs with the certificate expiry window each one covers, and stores the log's id rather than its name so a workflow keeps working when a log is renamed. Typed by hand it also takes a log id, a description as the log list writes it, or the log's URL.
How many entriescountnumber: How many of the newest entries to read. Paged behind the scenes, since logs cap how much of a range they serve at once.From 1 to 100. Default: 10.

Outputs

certificate_countnumber: How many of the returned entries are certificates
distinct_issuerslist: Which CAs issued them, most first
dns_nameslist: Every DNS name across the returned entries, deduplicated
entrieslist: The entries, newest first
logobject: Which log answered this
precertificate_countnumber: How many are precertificates
requestednumber: How many were asked for
returnednumber: How many entries came back
start_indexnumber: The first entry read
tree_head_published_attext: When the log signed that size; null for a tiled log
tree_sizenumber: How big the log was when this ran
unreadable_entriesnumber: How many could not be decoded

Example output

{
  "certificate_count": 6,
  "distinct_issuers": [
    {
      "count": 5,
      "issuer": "E7"
    },
    {
      "count": 3,
      "issuer": "WE1"
    },
    {
      "count": 2,
      "issuer": "ZeroSSL ECC DV SSL CA 2"
    }
  ],
  "dns_names": [
    "shop.example.com",
    "www.shop.example.com"
  ],
  "entries": [
    {
      "certificate": {
        "der_bytes": 1503,
        "dns_name_count": 2,
        "dns_names": [
          "shop.example.com",
          "www.shop.example.com"
        ],
        "embedded_sct_count": 2,
        "embedded_scts": [
          {
            "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=",
            "log_id_hex": "d76d7d10d1a7f577c2c7e95fd700bff982c9335a65e1d0b3017317c0c8c56977",
            "logged_at": "2026-08-27T20:22:12.042Z",
            "timestamp": 1787862132042
          },
          {
            "log_id": "3e+CLnzhZlDPAHiy21ZK1AYxbb1JDU5Xz6y7tOSaOF0=",
            "log_id_hex": "ddef822e7ce16650cf0078b2db564ad406316dbd490d4e57cfacbbb4e49a385d",
            "logged_at": "2026-08-27T20:22:10.118Z",
            "timestamp": 1787862130118
          }
        ],
        "fingerprint_sha256": "4973b48cf244e4981d43ff0485c347d50a22f0b827f9d0c96f9233a9e7646bf5",
        "fingerprint_sha256_base64": "SXO0jPJE5JgdQ/8EhcNH1Qoi8Lgn+dDJb5Izqedka/U=",
        "ip_addresses": [],
        "is_ca": false,
        "is_precertificate": false,
        "issuer": "C=US, O=Let's Encrypt, CN=E7",
        "issuer_country": "US",
        "issuer_name": "E7",
        "issuer_organization": "Let's Encrypt",
        "not_after": "2026-11-25T19:23:40Z",
        "not_before": "2026-08-27T19:23:41Z",
        "serial_number": "05eebb1d605d88f2cefb2343c4c80009817b",
        "subject": "CN=shop.example.com",
        "subject_common_name": "shop.example.com",
        "subject_organization": "",
        "validity_days": 90.0,
        "version": 3
      },
      "chain_fingerprints": [
        "a2372d06431e9716365eeed47ec020351497d182fcc038e457e58168a03cac07",
        "349dfa4058c5e263123b398ae795573c4e1313c83fe68f93556cd5e8031b3c7d"
      ],
      "chain_length": 2,
      "entry_type": "x509_entry",
      "index": 2750089397,
      "issuer_key_hash": null,
      "leaf_hash": "Ovw+MVXYy6mDh1kBu6RhbAyIYq5DBbfnzY3Y5Ki5g2M=",
      "leaf_hash_hex": "3afc3e3155d8cba983875901bba4616c0c8862ae4305b7e7cd8dd8e4a8b98363",
      "logged_at": "2026-08-27T20:22:12.042Z",
      "timestamp": 1787862132042
    }
  ],
  "log": {
    "description": "Google 'Argon2026h2' log",
    "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=",
    "log_type": "rfc6962",
    "operator": "Google",
    "state": "usable",
    "url": "https://ct.googleapis.com/logs/us1/argon2026h2/"
  },
  "precertificate_count": 4,
  "requested": 10,
  "returned": 10,
  "start_index": 2750089388,
  "tree_head_published_at": "2026-08-27T20:36:26.837Z",
  "tree_size": 2750089398,
  "unreadable_entries": 0
}

Get a log's tree head

Read how big a log is right now and the root hash that commits to everything in it. This is a log's heartbeat: the tree size says how many certificates it holds, and the root hash is what every proof is checked against. Record both to check later that nothing already published has changed. Works on either kind of log - it reads a signed tree head from an RFC 6962 log and a checkpoint from a tiled one - so a workflow does not have to know which it got. No account or API key required.

Inputs

LoglogtextRequired: Which log to read. This dropdown offers every log the list names, retired and rejected ones included, with the state on each label - a retired log still holds everything it ever held. Typed by hand it takes a log id, a description, or the log's URL.

Outputs

age_secondsnumber: How long ago that was; a healthy log signs a fresh one every few minutes. Null for a tiled log
logobject: Which log answered this
maximum_merge_delay_secondsnumber: How long the log may take to include something it accepted
published_attext: The same moment as ISO 8601, or null
root_hashtext: The Merkle root committing to all of them, base64
root_hash_hextext: The same root hash in hex
signaturetext: The log's signature over the tree head
signature_countnumber: How many signatures it carries; a tiled log's checkpoint is also signed by independent witnesses
sourcetext: 'get-sth' or 'checkpoint'
timestampnumber: When the log signed it, epoch milliseconds; null for a tiled log, whose checkpoint carries no time
tree_sizenumber: How many entries the log holds

Example output

{
  "age_seconds": 60.2,
  "log": {
    "description": "Google 'Argon2026h2' log",
    "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=",
    "log_type": "rfc6962",
    "operator": "Google",
    "state": "usable",
    "url": "https://ct.googleapis.com/logs/us1/argon2026h2/"
  },
  "maximum_merge_delay_seconds": 86400,
  "published_at": "2026-08-27T20:36:26.837Z",
  "root_hash": "7UlsX+cWAfvm+yRpz9z7CFEDg3Jd3Txoce0LJrtFrpk=",
  "root_hash_hex": "ed496c5fe71601fbe6fb2469cfdcfb08510383725ddd3c6871ed0b26bb45ae99",
  "signature": "BAMARjBEAiBw/VV5S3oX+67s8gZs1cj8WoCyLBo1zu1phkZLJ/3Jsg==",
  "signature_count": 1,
  "source": "get-sth",
  "timestamp": 1787862986837,
  "tree_size": 2750089398
}

Get a tiled log's checkpoint

Read a tiled log's checkpoint in full: the signed note it publishes in place of a signed tree head, with its origin line, its size, its root hash and every signature on it - including the independent witnesses that co-sign it, which is what makes a tiled log's word harder to take back. Use 'Get a log's tree head' when all that is wanted is the size and the root; use this when the signatures themselves matter. Only tiled logs serve it. No account or API key required.

Inputs

LoglogtextRequired: Which tiled log to read. Only tiled (static-ct-api) logs serve this, so the dropdown offers those. Two thirds of the logs in the list are now tiled.

Outputs

extension_lineslist: Any extra body lines the note carries
logobject: Which log answered this
origintext: The name the log signs under, usually its hostname
rawtext: The checkpoint exactly as served
root_hashtext: The Merkle root hash, base64
root_hash_hextext: The same root hash in hex
signature_countnumber: How many signatures that is
signature_lineslist: Every signature line, as written: the log's own first, then any witnesses'
tree_sizenumber: How many entries it holds

Example output

{
  "extension_lines": [],
  "log": {
    "description": "Google 'ParcelYard2026h2' log",
    "log_id": "utuIpG+cr6QJDoLlk1bbbni0pT9YLbCBl5UkLym2jJg=",
    "log_type": "tiled",
    "operator": "Google",
    "state": "qualified",
    "url": "https://parcelyard2026h2.prod.certificate.transparency.goog/"
  },
  "origin": "parcelyard2026h2.prod.certificate.transparency.goog",
  "raw": "parcelyard2026h2.prod.certificate.transparency.goog\n1073943772\nkZ2nCJ1Lhp6xsRThmBTWVVOxOBk4Q3D1HXB/dtykVNY=\n",
  "root_hash": "kZ2nCJ1Lhp6xsRThmBTWVVOxOBk4Q3D1HXB/dtykVNY=",
  "root_hash_hex": "919da7089d4b869eb1b114e19814d65553b13819384370f51d707f76dca454d6",
  "signature_count": 4,
  "signature_lines": [
    "\u2014 parcelyard2026h2.prod.certificate.transparency.goog k6eK4AAA",
    "\u2014 witness.navigli.sunlight.geomys.org o+AP4gAAAABqkJ50IrG0u4At"
  ],
  "tree_size": 1073943772
}

Get an entry with its proof

Read the entry at a given position and prove it is in the log, in one call. The certificate comes back decoded and the proof is checked against the log's current root, so a workflow can quote a certificate and say in the same breath that the log stands behind it. Only RFC 6962 logs serve this. No account or API key required.

Inputs

LoglogtextRequired: Which log to ask for the proof. Only RFC 6962 logs serve proofs, so this dropdown offers those; a tiled log builds proofs from its hash tiles instead of answering for them.
Entry numberleaf_indexnumberRequired: Which entry to read, counting from zero. The last entry's number is one less than the log's size.At least 0.
Tree size to prove againsttree_sizenumber: The size of the tree the proof should be made for. Leave empty to use the log's current size, which is the usual case and the only one this can verify for you - an older size can be asked for, but its root hash is not published anywhere, so the proof comes back unchecked.At least 1.

Outputs

audit_pathlist: The sibling hashes proving it, base64
audit_path_lengthnumber: How many hashes that is
current_tree_sizenumber: How big the log is now
entryobject: The entry at that position, decoded
leaf_indexnumber: The entry number read
logobject: Which log answered this
tree_sizenumber: The tree size the proof was made for
verifiedtrue/false: Whether the proof checked out against the log's current root; null when asked for at an older size
verified_against_root_hashtext: The root hash it was checked against

Example output

{
  "audit_path": [
    "zUprTGcJYOBkfViwX6OlVgwioJEyl0zrXek7vT7uBrw="
  ],
  "audit_path_length": 22,
  "current_tree_size": 2750090248,
  "entry": {
    "certificate": {
      "der_bytes": 1503,
      "dns_name_count": 2,
      "dns_names": [
        "shop.example.com",
        "www.shop.example.com"
      ],
      "embedded_sct_count": 2,
      "embedded_scts": [
        {
          "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=",
          "log_id_hex": "d76d7d10d1a7f577c2c7e95fd700bff982c9335a65e1d0b3017317c0c8c56977",
          "logged_at": "2026-08-27T20:22:12.042Z",
          "timestamp": 1787862132042
        },
        {
          "log_id": "3e+CLnzhZlDPAHiy21ZK1AYxbb1JDU5Xz6y7tOSaOF0=",
          "log_id_hex": "ddef822e7ce16650cf0078b2db564ad406316dbd490d4e57cfacbbb4e49a385d",
          "logged_at": "2026-08-27T20:22:10.118Z",
          "timestamp": 1787862130118
        }
      ],
      "fingerprint_sha256": "4973b48cf244e4981d43ff0485c347d50a22f0b827f9d0c96f9233a9e7646bf5",
      "fingerprint_sha256_base64": "SXO0jPJE5JgdQ/8EhcNH1Qoi8Lgn+dDJb5Izqedka/U=",
      "ip_addresses": [],
      "is_ca": false,
      "is_precertificate": false,
      "issuer": "C=US, O=Let's Encrypt, CN=E7",
      "issuer_country": "US",
      "issuer_name": "E7",
      "issuer_organization": "Let's Encrypt",
      "not_after": "2026-11-25T19:23:40Z",
      "not_before": "2026-08-27T19:23:41Z",
      "serial_number": "05eebb1d605d88f2cefb2343c4c80009817b",
      "subject": "CN=shop.example.com",
      "subject_common_name": "shop.example.com",
      "subject_organization": "",
      "validity_days": 90.0,
      "version": 3
    },
    "chain_fingerprints": [
      "a2372d06431e9716365eeed47ec020351497d182fcc038e457e58168a03cac07",
      "349dfa4058c5e263123b398ae795573c4e1313c83fe68f93556cd5e8031b3c7d"
    ],
    "chain_length": 2,
    "entry_type": "x509_entry",
    "index": 2750089397,
    "issuer_key_hash": null,
    "leaf_hash": "Ovw+MVXYy6mDh1kBu6RhbAyIYq5DBbfnzY3Y5Ki5g2M=",
    "leaf_hash_hex": "3afc3e3155d8cba983875901bba4616c0c8862ae4305b7e7cd8dd8e4a8b98363",
    "logged_at": "2026-08-27T20:22:12.042Z",
    "timestamp": 1787862132042
  },
  "leaf_index": 2750089397,
  "log": {
    "description": "Google 'Argon2026h2' log",
    "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=",
    "log_type": "rfc6962",
    "operator": "Google",
    "state": "usable",
    "url": "https://ct.googleapis.com/logs/us1/argon2026h2/"
  },
  "tree_size": 2750090248,
  "verified": true,
  "verified_against_root_hash": "7UlsX+cWAfvm+yRpz9z7CFEDg3Jd3Txoce0LJrtFrpk="
}

Get an issuer certificate

Fetch one of the CA certificates a tiled log stores, by its SHA-256 fingerprint, decoded and also as PEM ready to paste into another tool. A tiled log's entries name their issuing chain by fingerprint rather than carrying it, so this is how the intermediate that signed a certificate is read - take a fingerprint from an entry's chain and look it up here. A log stores only the CA certificates it has actually been shown. No account or API key required.

Inputs

LoglogtextRequired: Which tiled log to read. Only tiled (static-ct-api) logs serve this, so the dropdown offers those. Two thirds of the logs in the list are now tiled.
Certificate fingerprintfingerprinttextRequired: The SHA-256 fingerprint of the CA certificate to fetch, as 64 hex characters or the same bytes in base64. Entries returned by this integration carry their chain's fingerprints ready to use.

Outputs

certificateobject: The CA certificate, decoded
certificate_pemtext: The same certificate as PEM, for pasting into another tool
fingerprinttext: The fingerprint fetched, in hex
logobject: Which log answered this

Example output

{
  "certificate": {
    "der_bytes": 1391,
    "dns_name_count": 0,
    "dns_names": [],
    "embedded_sct_count": 0,
    "embedded_scts": [],
    "fingerprint_sha256": "96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6",
    "fingerprint_sha256_base64": "lrzsBiZJdvN0YHeazyjFp8/oo8Cq4RqP/O4FwL3fCMY=",
    "ip_addresses": [],
    "is_ca": true,
    "is_precertificate": false,
    "issuer": "C=US, O=Internet Security Research Group, CN=ISRG Root X1",
    "issuer_country": "US",
    "issuer_name": "ISRG Root X1",
    "issuer_organization": "Internet Security Research Group",
    "not_after": "2035-06-04T11:04:38Z",
    "not_before": "2015-06-04T11:04:38Z",
    "serial_number": "0a0142800000014523c844b500000002",
    "subject": "C=US, O=Internet Security Research Group, CN=ISRG Root X1",
    "subject_common_name": "ISRG Root X1",
    "subject_organization": "Internet Security Research Group",
    "validity_days": 7305.0,
    "version": 3
  },
  "certificate_pem": "-----BEGIN CERTIFICATE-----\nMIIFYDCCBEigAwIBAgIQQAF3\n-----END CERTIFICATE-----",
  "fingerprint": "1dfc1605fbad358d8bc844f76d15203fac9ca5c1a79fd4857ffaf2864fbebf96",
  "log": {
    "description": "Google 'ParcelYard2026h2' log",
    "log_id": "utuIpG+cr6QJDoLlk1bbbni0pT9YLbCBl5UkLym2jJg=",
    "log_type": "tiled",
    "operator": "Google",
    "state": "qualified",
    "url": "https://parcelyard2026h2.prod.certificate.transparency.goog/"
  }
}

Get entries from a log

Read a range of a log's entries and decode the certificate in each one: the domain names it covers, who issued it, when it was issued and when it expires, its fingerprint, and the signed timestamps its CA embedded. Entries are numbered from zero and never move, so a workflow can pick up exactly where it left off. Works on either kind of log. No account or API key required.

Inputs

LoglogtextRequired: Which Certificate Transparency log to read. The dropdown lists the usable and qualified logs with the certificate expiry window each one covers, and stores the log's id rather than its name so a workflow keeps working when a log is renamed. Typed by hand it also takes a log id, a description as the log list writes it, or the log's URL.
Start at entrystart_indexnumberRequired: The first entry to read, counting from zero. Entry numbers never change, so the end index of a previous run plus one carries on from where it stopped.At least 0.
How many entriescountnumber: How many entries to read. Logs cap how much of a range they will serve in one answer - Google's return 32 - so this is paged behind the scenes until the count is met.From 1 to 100. Default: 10.

Outputs

certificate_countnumber: How many of the returned entries are certificates
distinct_issuerslist: Which CAs issued them, most first
dns_nameslist: Every DNS name across the returned entries, deduplicated
end_indexnumber: The last entry read; add one to continue from here
entrieslist: The entries, oldest first
logobject: Which log answered this
precertificate_countnumber: How many are precertificates
requestednumber: How many were asked for
returnednumber: How many entries came back
start_indexnumber: The first entry read
unreadable_entriesnumber: How many could not be decoded; normally zero

Example output

{
  "certificate_count": 6,
  "distinct_issuers": [
    {
      "count": 5,
      "issuer": "E7"
    },
    {
      "count": 3,
      "issuer": "WE1"
    },
    {
      "count": 2,
      "issuer": "ZeroSSL ECC DV SSL CA 2"
    }
  ],
  "dns_names": [
    "shop.example.com",
    "www.shop.example.com"
  ],
  "end_index": 2750089397,
  "entries": [
    {
      "certificate": {
        "der_bytes": 1503,
        "dns_name_count": 2,
        "dns_names": [
          "shop.example.com",
          "www.shop.example.com"
        ],
        "embedded_sct_count": 2,
        "embedded_scts": [
          {
            "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=",
            "log_id_hex": "d76d7d10d1a7f577c2c7e95fd700bff982c9335a65e1d0b3017317c0c8c56977",
            "logged_at": "2026-08-27T20:22:12.042Z",
            "timestamp": 1787862132042
          },
          {
            "log_id": "3e+CLnzhZlDPAHiy21ZK1AYxbb1JDU5Xz6y7tOSaOF0=",
            "log_id_hex": "ddef822e7ce16650cf0078b2db564ad406316dbd490d4e57cfacbbb4e49a385d",
            "logged_at": "2026-08-27T20:22:10.118Z",
            "timestamp": 1787862130118
          }
        ],
        "fingerprint_sha256": "4973b48cf244e4981d43ff0485c347d50a22f0b827f9d0c96f9233a9e7646bf5",
        "fingerprint_sha256_base64": "SXO0jPJE5JgdQ/8EhcNH1Qoi8Lgn+dDJb5Izqedka/U=",
        "ip_addresses": [],
        "is_ca": false,
        "is_precertificate": false,
        "issuer": "C=US, O=Let's Encrypt, CN=E7",
        "issuer_country": "US",
        "issuer_name": "E7",
        "issuer_organization": "Let's Encrypt",
        "not_after": "2026-11-25T19:23:40Z",
        "not_before": "2026-08-27T19:23:41Z",
        "serial_number": "05eebb1d605d88f2cefb2343c4c80009817b",
        "subject": "CN=shop.example.com",
        "subject_common_name": "shop.example.com",
        "subject_organization": "",
        "validity_days": 90.0,
        "version": 3
      },
      "chain_fingerprints": [
        "a2372d06431e9716365eeed47ec020351497d182fcc038e457e58168a03cac07",
        "349dfa4058c5e263123b398ae795573c4e1313c83fe68f93556cd5e8031b3c7d"
      ],
      "chain_length": 2,
      "entry_type": "x509_entry",
      "index": 2750089397,
      "issuer_key_hash": null,
      "leaf_hash": "Ovw+MVXYy6mDh1kBu6RhbAyIYq5DBbfnzY3Y5Ki5g2M=",
      "leaf_hash_hex": "3afc3e3155d8cba983875901bba4616c0c8862ae4305b7e7cd8dd8e4a8b98363",
      "logged_at": "2026-08-27T20:22:12.042Z",
      "timestamp": 1787862132042
    }
  ],
  "log": {
    "description": "Google 'Argon2026h2' log",
    "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=",
    "log_type": "rfc6962",
    "operator": "Google",
    "state": "usable",
    "url": "https://ct.googleapis.com/logs/us1/argon2026h2/"
  },
  "precertificate_count": 4,
  "requested": 10,
  "returned": 10,
  "start_index": 2750089388,
  "unreadable_entries": 0
}

List Certificate Transparency logs

List the Certificate Transparency logs, from the same published list Chrome itself uses. Each one comes back with who runs it, its URL, its state, whether it speaks the RFC 6962 API or the newer tiled format, and - the part that usually decides which log to read - the window of certificate expiry dates it accepts, because logs are sharded by year. Filter by state, by operator, by kind, or by a word in the name. Start here when a workflow needs to pick a log. No account or API key required.

Inputs

Statesstatestext: Only logs in these states. A log's state is what says whether it is worth reading: browsers only trust certificates logged to a usable one, a retired log is frozen, and a rejected one failed qualification and proves nothing. Choose none to see every log.One or more of: usable (Usable - trusted, and taking new certificates), qualified (Qualified - passed its tests, being included), pending (Pending - has asked to be included), readonly (Read-only - frozen, but still readable), retired (Retired - no longer trusted for new certificates), rejected (Rejected - failed qualification), unknown (Unknown - the list gives no state (test and mirror logs)).
Operatoroperatortext: Only logs run by this organisation. Leave empty for all of them.
Log softwarelog_typetext: Only logs of this kind. RFC 6962 logs answer the original JSON API and are the only ones that serve proofs; tiled logs publish static files instead. Reading tree heads and entries works on either.One of: any (Either kind), rfc6962 (RFC 6962 - the original API, and serves proofs), tiled (Tiled (static-ct-api) - the newer, static format). Default: any.
Search forquerytext: Only logs whose name, URL or operator contains this text, matched without regard to case. Leave empty for all of them.
Sort bysort_bytext: What order the logs come back in.One of: operator (Operator, then log name), description (Log name), state (State, most useful first), expiry_window (The expiry window the log covers). Default: operator.
How many to returnlimitnumber: How many logs to return. The list holds about 120 logs in total, so the default of 50 covers every usable one.From 1 to 250. Default: 50.

Outputs

log_list_updated_attext: When that version was published
log_list_versiontext: The version of the published list read
logslist: The matching logs, capped by the limit
match_countnumber: How many matched before the limit
returnednumber: How many logs came back
source_urltext: The Certificate Transparency project page
states_filteredlist: The states asked for, if any
total_logsnumber: How many logs were in the list this read: the shorter published list unless retired or rejected logs were asked for, in which case the full one

Example output

{
  "log_list_updated_at": "2026-08-27T13:36:56Z",
  "log_list_version": "89.32",
  "logs": [
    {
      "accepts_expiry_from": "2026-07-01T00:00:00Z",
      "accepts_expiry_until": "2027-01-01T00:00:00Z",
      "description": "Google 'Argon2026h2' log",
      "final_tree_size": null,
      "is_usable": true,
      "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=",
      "log_id_hex": "d76d7d10d1a7f577c2c7e95fd700bff982c9335a65e1d0b3017317c0c8c56977",
      "log_type": "rfc6962",
      "maximum_merge_delay_seconds": 86400,
      "monitoring_url": "https://ct.googleapis.com/logs/us1/argon2026h2/",
      "operator": "Google",
      "operator_emails": [
        "google-ct-logs@googlegroups.com"
      ],
      "public_key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKjpni/66DIYrSlGK6Rf+e6F2c/28ZUvDJ79N81+gyimAESAyeNZ++TRgjHWg9TVQnKHTSU0T1TtqDupFnSQTIg==",
      "state": "usable",
      "state_since": "2024-09-30T22:19:27Z",
      "submission_url": "https://ct.googleapis.com/logs/us1/argon2026h2/",
      "url": "https://ct.googleapis.com/logs/us1/argon2026h2/"
    },
    {
      "accepts_expiry_from": "2026-01-01T00:00:00Z",
      "accepts_expiry_until": "2027-01-01T00:00:00Z",
      "description": "Cloudflare 'Nimbus2026'",
      "final_tree_size": null,
      "is_usable": true,
      "log_id": "3e+CLnzhZlDPAHiy21ZK1AYxbb1JDU5Xz6y7tOSaOF0=",
      "log_id_hex": "ddef822e7ce16650cf0078b2db564ad406316dbd490d4e57cfacbbb4e49a385d",
      "log_type": "rfc6962",
      "maximum_merge_delay_seconds": 86400,
      "monitoring_url": "https://ct.cloudflare.com/logs/nimbus2026/",
      "operator": "Cloudflare",
      "operator_emails": [
        "ct-logs@cloudflare.com"
      ],
      "public_key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE",
      "state": "usable",
      "state_since": "2023-05-23T20:00:00Z",
      "submission_url": "https://ct.cloudflare.com/logs/nimbus2026/",
      "url": "https://ct.cloudflare.com/logs/nimbus2026/"
    }
  ],
  "match_count": 43,
  "returned": 2,
  "source_url": "https://certificate.transparency.dev",
  "states_filtered": [
    "usable"
  ],
  "total_logs": 122
}

List log operators

List the organisations that run Certificate Transparency logs - Google, Cloudflare, Let's Encrypt, DigiCert, Sectigo and the rest - with how many logs each runs, how many of those are usable, how they split between the two log formats, and the contact addresses they publish. Useful for spreading monitoring across operators, which is the point of having several. No account or API key required.

Inputs

Count retired and rejected logs tooinclude_all_logstrue/false: Off by default, so the counts describe the logs worth reading. Turn it on to count every log an operator has ever run.Default: false.

Outputs

includes_retired_and_rejectedtrue/false: Whether retired and rejected logs were counted
log_countnumber: How many logs they run between them
operator_countnumber: How many operators there are
operatorslist: The operators, those running most usable logs first
source_urltext: The Certificate Transparency project page

Example output

{
  "includes_retired_and_rejected": false,
  "log_count": 48,
  "operator_count": 8,
  "operators": [
    {
      "emails": [
        "google-ct-logs@googlegroups.com"
      ],
      "log_count": 10,
      "log_descriptions": [
        "Google 'Argon2026h2' log"
      ],
      "name": "Google",
      "rfc6962_log_count": 6,
      "tiled_log_count": 4,
      "usable_log_count": 10
    },
    {
      "emails": [
        "ct-logs@letsencrypt.org"
      ],
      "log_count": 7,
      "log_descriptions": [
        "Let's Encrypt 'Oak2026h2'"
      ],
      "name": "Let's Encrypt",
      "rfc6962_log_count": 4,
      "tiled_log_count": 3,
      "usable_log_count": 6
    }
  ],
  "source_url": "https://certificate.transparency.dev"
}

List the roots a log accepts

List the CA root certificates a log will accept chains up to, each decoded into its subject, its issuer, its validity dates and its SHA-256 fingerprint. A typical log accepts several hundred. Use it to check whether a particular CA can log to a particular log at all, or to take a fingerprint to look a certificate up with. Filter by any text in the subject or issuer. No account or API key required.

Inputs

LoglogtextRequired: Which Certificate Transparency log to read. The dropdown lists the usable and qualified logs with the certificate expiry window each one covers, and stores the log's id rather than its name so a workflow keeps working when a log is renamed. Typed by hand it also takes a log id, a description as the log list writes it, or the log's URL.
Search forquerytext: Only roots whose subject or issuer contains this text, matched without regard to case. Leave empty for all of them.
How many to returnlimitnumber: How many roots to return. The default of 25 keeps a step's result readable; a log accepts several hundred, so raise it when a later step needs the whole set.From 1 to 1000. Default: 25.

Outputs

logobject: Which log answered this
match_countnumber: How many matched before the limit
returnednumber: How many roots came back
rootslist: The matching root certificates, by name
total_rootsnumber: How many roots the log accepts in all
unreadable_rootsnumber: How many the log sent that could not be decoded; normally zero

Example output

{
  "log": {
    "description": "Google 'Argon2026h2' log",
    "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=",
    "log_type": "rfc6962",
    "operator": "Google",
    "state": "usable",
    "url": "https://ct.googleapis.com/logs/us1/argon2026h2/"
  },
  "match_count": 1,
  "returned": 1,
  "roots": [
    {
      "der_bytes": 1391,
      "dns_name_count": 0,
      "dns_names": [],
      "embedded_sct_count": 0,
      "embedded_scts": [],
      "fingerprint_sha256": "96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6",
      "fingerprint_sha256_base64": "lrzsBiZJdvN0YHeazyjFp8/oo8Cq4RqP/O4FwL3fCMY=",
      "ip_addresses": [],
      "is_ca": true,
      "is_precertificate": false,
      "issuer": "C=US, O=Internet Security Research Group, CN=ISRG Root X1",
      "issuer_country": "US",
      "issuer_name": "ISRG Root X1",
      "issuer_organization": "Internet Security Research Group",
      "not_after": "2035-06-04T11:04:38Z",
      "not_before": "2015-06-04T11:04:38Z",
      "serial_number": "0a0142800000014523c844b500000002",
      "subject": "C=US, O=Internet Security Research Group, CN=ISRG Root X1",
      "subject_common_name": "ISRG Root X1",
      "subject_organization": "Internet Security Research Group",
      "validity_days": 7305.0,
      "version": 3
    }
  ],
  "total_roots": 669,
  "unreadable_roots": 0
}

Prove a log has only appended

Ask a log to prove that everything it published at an earlier size is still there, unchanged, in the log as it is now. This is the check that makes a transparency log worth the name, and it is what monitoring one looks like: record a tree head's size and root hash today, hand both back tomorrow, and get a yes or a no. Without the earlier root hash the proof is still returned, but nothing can be checked against it. Only RFC 6962 logs serve proofs. No account or API key required.

Inputs

LoglogtextRequired: Which log to ask for the proof. Only RFC 6962 logs serve proofs, so this dropdown offers those; a tiled log builds proofs from its hash tiles instead of answering for them.
Earlier tree sizefirst_sizenumberRequired: The size the log was when you last looked. Take it from a tree head you recorded.At least 1.
Earlier root hashfirst_root_hashtext: The root hash the log reported at that size. Supply it and the proof is verified for you; leave it empty and the proof comes back unchecked, because a log does not publish its own history. Base64 or hex.
Later tree sizesecond_sizenumber: The size to compare against. Leave empty for the log's current size, which is the only one whose root hash is published and so the only one this can verify against.At least 1.

Outputs

current_tree_sizenumber: How big the log is now
entries_addednumber: How many entries were added in between
first_root_hashtext: The earlier root hash that was supplied, or null
first_sizenumber: The earlier size compared from
is_currenttrue/false: Whether the later size is the log's current size
logobject: Which log answered this
not_verified_becausetext: Why nothing was checked, when nothing was
prooflist: The proof's node hashes, base64
proof_lengthnumber: How many hashes that is
second_root_hashtext: The later root hash, when the later size is the current one; null otherwise
second_sizenumber: The later size compared to
verifiedtrue/false: True when the proof connects both roots, false when it does not, null when there was not enough to check it with

Example output

{
  "current_tree_size": 2750092323,
  "entries_added": 6,
  "first_root_hash": "7UlsX+cWAfvm+yRpz9z7CFEDg3Jd3Txoce0LJrtFrpk=",
  "first_size": 2750092317,
  "is_current": true,
  "log": {
    "description": "Google 'Argon2026h2' log",
    "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=",
    "log_type": "rfc6962",
    "operator": "Google",
    "state": "usable",
    "url": "https://ct.googleapis.com/logs/us1/argon2026h2/"
  },
  "not_verified_because": null,
  "proof": [
    "zUprTGcJYOBkfViwX6OlVgwioJEyl0zrXek7vT7uBrw="
  ],
  "proof_length": 19,
  "second_root_hash": "NB0qoL7oMjWNb6/3NT5QsrYsIf9zuQaJeUhp+0hndnU=",
  "second_size": 2750092323,
  "verified": true
}

Prove an entry is in a log

Ask a log to prove that an entry really is in it, and check the proof. Give it the leaf hash any entry-reading action returns; the log answers with the hashes that connect that entry to its root, and those are recomputed here against the log's own current root hash. A true answer is the log's commitment made good; a false one means what the log said does not add up. Only RFC 6962 logs serve proofs. No account or API key required.

Inputs

LoglogtextRequired: Which log to ask for the proof. Only RFC 6962 logs serve proofs, so this dropdown offers those; a tiled log builds proofs from its hash tiles instead of answering for them.
Entry's leaf hashleaf_hashtextRequired: The Merkle leaf hash of the entry to prove, which every entry this integration returns carries as 'leaf_hash'. Base64 or hex.
Tree size to prove againsttree_sizenumber: The size of the tree the proof should be made for. Leave empty to use the log's current size, which is the usual case and the only one this can verify for you - an older size can be asked for, but its root hash is not published anywhere, so the proof comes back unchecked.At least 1.

Outputs

audit_pathlist: The sibling hashes that connect the entry to the root, base64, from the leaf upwards
audit_path_lengthnumber: How many hashes that is
current_tree_sizenumber: How big the log is now
leaf_hashtext: The leaf hash asked about, base64
leaf_indexnumber: Where the log says that entry sits
logobject: Which log answered this
tree_sizenumber: The tree size the proof was made for
verifiedtrue/false: Whether recomputing the root from the entry and the path matched the log's own root. Null when the proof was asked for at an older tree size, whose root is not published
verified_against_root_hashtext: The root hash it was checked against

Example output

{
  "audit_path": [
    "zUprTGcJYOBkfViwX6OlVgwioJEyl0zrXek7vT7uBrw=",
    "7zWBMNkajvykvRUsmNjKqB7asXpjyuKi0Nw3ROBguz0="
  ],
  "audit_path_length": 21,
  "current_tree_size": 2750090137,
  "leaf_hash": "Ovw+MVXYy6mDh1kBu6RhbAyIYq5DBbfnzY3Y5Ki5g2M=",
  "leaf_index": 2750089397,
  "log": {
    "description": "Google 'Argon2026h2' log",
    "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=",
    "log_type": "rfc6962",
    "operator": "Google",
    "state": "usable",
    "url": "https://ct.googleapis.com/logs/us1/argon2026h2/"
  },
  "tree_size": 2750090137,
  "verified": true,
  "verified_against_root_hash": "7UlsX+cWAfvm+yRpz9z7CFEDg3Jd3Txoce0LJrtFrpk="
}

Summarize the log list

Read which version of the published Certificate Transparency log list is current, when it was published, and what it holds: how many logs there are in each state, how they split between the RFC 6962 and tiled formats, how many operators run them, and the range of certificate expiry dates the logs cover between them. Run it to check for a new version of the list before doing anything else. No account or API key required.

Inputs

None.

Outputs

earliest_expiry_window_starttext: The earliest expiry date any log accepts
latest_expiry_window_endtext: The latest expiry date any log accepts
log_list_urltext: Where the list was read from
logs_by_statelist: The same counts as rows, largest first
operator_countnumber: How many organisations run them
pending_logsnumber: How many are pending
qualified_logsnumber: How many are qualified
readonly_logsnumber: How many are read-only
rejected_logsnumber: How many were rejected
retired_logsnumber: How many are retired
rfc6962_logsnumber: How many speak the RFC 6962 API
source_urltext: The Certificate Transparency project page
tiled_logsnumber: How many are tiled (static-ct-api) logs
total_logsnumber: How many logs it names in all
updated_attext: When it was published, ISO 8601
usable_logsnumber: How many are usable
versiontext: The list's version, e.g. '89.32'

Example output

{
  "earliest_expiry_window_start": "2020-01-01T08:00:00Z",
  "latest_expiry_window_end": "2029-01-01T00:00:00Z",
  "log_list_url": "https://www.gstatic.com/ct/log_list/v3/log_list.json",
  "logs_by_state": [
    {
      "count": 37,
      "state": "usable"
    },
    {
      "count": 21,
      "state": "pending"
    },
    {
      "count": 14,
      "state": "rejected"
    }
  ],
  "operator_count": 10,
  "pending_logs": 21,
  "qualified_logs": 6,
  "readonly_logs": 2,
  "rejected_logs": 14,
  "retired_logs": 3,
  "rfc6962_logs": 42,
  "source_url": "https://certificate.transparency.dev",
  "tiled_logs": 80,
  "total_logs": 122,
  "updated_at": "2026-08-27T13:36:56Z",
  "usable_logs": 37,
  "version": "89.32"
}

Certificate Transparency

ActionsCopy Anchor Link

Find certificates for a domain in a logCopy Anchor Link

Inputs

Outputs

Find logs for a certificate expiry dateCopy Anchor Link

Inputs

Outputs

Get a logCopy Anchor Link

Inputs

Outputs

Get a log's newest entriesCopy Anchor Link

Inputs

Outputs

Get a log's tree headCopy Anchor Link

Inputs

Outputs

Get a tiled log's checkpointCopy Anchor Link

Inputs

Outputs

Get an entry with its proofCopy Anchor Link

Inputs

Outputs

Get an issuer certificateCopy Anchor Link

Inputs

Outputs

Get entries from a logCopy Anchor Link

Inputs

Outputs

List Certificate Transparency logsCopy Anchor Link

Inputs

Outputs

List log operatorsCopy Anchor Link

Inputs

Outputs

List the roots a log acceptsCopy Anchor Link

Inputs

Outputs

Prove a log has only appendedCopy Anchor Link

Inputs

Outputs

Prove an entry is in a logCopy Anchor Link

Inputs

Outputs

Summarize the log listCopy Anchor Link

Inputs

Outputs

On this page

Actions

Find certificates for a domain in a log

Find logs for a certificate expiry date

Get a log

Get a log's newest entries

Get a log's tree head

Get a tiled log's checkpoint

Get an entry with its proof

Get an issuer certificate

Get entries from a log

List Certificate Transparency logs

List log operators

List the roots a log accepts

Prove a log has only appended

Prove an entry is in a log

Summarize the log list