# Certificate Transparency > Read the public Certificate Transparency logs from a workflow. Every publicly trusted certificate on the web has to be published to these append-only logs before a browser will accept it, so they are the one place that can answer what certificates exist for a name and who issued them without asking the certificate authority. Browse the logs Chrome itself trusts and who runs them, work out which one could hold a certificate from its expiry date, read a log's size and root hash, list the CA roots it accepts, and read its newest entries with every certificate decoded into its domain names, issuer and validity - or scan for the ones covering a domain you own, which is how a workflow catches a certificate nobody meant to issue. Ask a log to prove an entry is really in it, or that it has only ever appended, and the proof is checked for you. Works with both the original RFC 6962 logs and the newer tiled ones. Every action reads: nothing here changes anything. No account or API key required. App · Compliance & Security · 15 actions. Web page: https://docs.lodol.com/docs/integrations/certificate-transparency ## Actions ### Find certificates for a domain in a log Scan the newest stretch of a log for certificates covering a domain, optionally including its subdomains. This is how a workflow catches a certificate being issued for a name it owns - the thing Certificate Transparency exists to make visible. Narrow it further by issuing CA, by certificate or precertificate, and by the moment the log accepted it. A log has no search of its own, so this reads entries from the end backwards and filters them here; how far back it looks is up to you, and it says how many it read. No account or API key required. **Inputs** - Log (`log`, text, required): Which Certificate Transparency log to read. The dropdown lists the usable and qualified logs with the certificate expiry window each one covers, and stores the log's id rather than its name so a workflow keeps working when a log is renamed. Typed by hand it also takes a log id, a description as the log list writes it, or the log's URL. - Domain (`domain`, text, required): The domain to look for, such as example.com. Matched against every name on the certificate; a wildcard certificate matches its own parent domain when subdomains are included. A name read off an earlier step works as it comes: a leading '*.' is dropped, since searching for '*.example.com' means the same thing as searching for 'example.com'. - Include subdomains (`include_subdomains`, true/false): Also match names under the domain, so example.com finds shop.example.com and *.example.com. Default: `false`. - Issued by (`issuer`, text): Only certificates whose issuer contains this text, matched without regard to case. Use it to spot a certificate from a CA you do not use. - Entry kind (`entry_type`, text): Whether to count certificates, precertificates, or both. A CA logs a precertificate before it issues, so the same certificate usually appears as both. One of: `any` (Both kinds), `x509_entry` (Certificates only), `precert_entry` (Precertificates only). Default: `any`. - Only entries logged after (`logged_after`, date and time): Only entries the log accepted after this moment. Leave empty for everything in the scanned range. Set it to the last run's finish time to see only what is new. - How many entries to scan (`scan_entries`, number): How far back from the end of the log to look. Bigger means more requests and a slower step; the result always says how many entries were actually read and the oldest moment reached. From 1 to 500. Default: `100`. **Outputs** - `certificate_count` (number): How many of the returned entries are certificates - `distinct_issuers` (list): Which CAs issued them, most first - `dns_names` (list): Every DNS name across the returned entries, deduplicated - `domain` (text): The domain looked for, normalised - `entries_scanned` (number): How many entries were actually read - `include_subdomains` (true/false): Whether names under it were matched too - `log` (object): Which log answered this - `match_count` (number): How many matched - `matches` (list): The matching entries, newest first - `newest_scanned_at` (text): The newest moment the scan reached - `oldest_scanned_at` (text): The oldest moment the scan reached - how far back this answer actually covers - `precertificate_count` (number): How many are precertificates - `scan_requested` (number): How many were asked to be read - `scanned_from_index` (number): The entry the scan started at - `tree_size` (number): How big the log was when this ran - `unreadable_entries` (number): How many could not be decoded **Example output** ```json { "certificate_count": 1, "distinct_issuers": [ { "count": 1, "issuer": "E7" } ], "dns_names": [ "shop.example.com", "www.shop.example.com" ], "domain": "example.com", "entries_scanned": 100, "include_subdomains": true, "log": { "description": "Google 'Argon2026h2' log", "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=", "log_type": "rfc6962", "operator": "Google", "state": "usable", "url": "https://ct.googleapis.com/logs/us1/argon2026h2/" }, "match_count": 1, "matches": [ { "certificate": { "der_bytes": 1503, "dns_name_count": 2, "dns_names": [ "shop.example.com", "www.shop.example.com" ], "embedded_sct_count": 2, "embedded_scts": [ { "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=", "log_id_hex": "d76d7d10d1a7f577c2c7e95fd700bff982c9335a65e1d0b3017317c0c8c56977", "logged_at": "2026-08-27T20:22:12.042Z", "timestamp": 1787862132042 }, { "log_id": "3e+CLnzhZlDPAHiy21ZK1AYxbb1JDU5Xz6y7tOSaOF0=", "log_id_hex": "ddef822e7ce16650cf0078b2db564ad406316dbd490d4e57cfacbbb4e49a385d", "logged_at": "2026-08-27T20:22:10.118Z", "timestamp": 1787862130118 } ], "fingerprint_sha256": "4973b48cf244e4981d43ff0485c347d50a22f0b827f9d0c96f9233a9e7646bf5", "fingerprint_sha256_base64": "SXO0jPJE5JgdQ/8EhcNH1Qoi8Lgn+dDJb5Izqedka/U=", "ip_addresses": [], "is_ca": false, "is_precertificate": false, "issuer": "C=US, O=Let's Encrypt, CN=E7", "issuer_country": "US", "issuer_name": "E7", "issuer_organization": "Let's Encrypt", "not_after": "2026-11-25T19:23:40Z", "not_before": "2026-08-27T19:23:41Z", "serial_number": "05eebb1d605d88f2cefb2343c4c80009817b", "subject": "CN=shop.example.com", "subject_common_name": "shop.example.com", "subject_organization": "", "validity_days": 90.0, "version": 3 }, "chain_fingerprints": [ "a2372d06431e9716365eeed47ec020351497d182fcc038e457e58168a03cac07", "349dfa4058c5e263123b398ae795573c4e1313c83fe68f93556cd5e8031b3c7d" ], "chain_length": 2, "entry_type": "x509_entry", "index": 2750089397, "issuer_key_hash": null, "leaf_hash": "Ovw+MVXYy6mDh1kBu6RhbAyIYq5DBbfnzY3Y5Ki5g2M=", "leaf_hash_hex": "3afc3e3155d8cba983875901bba4616c0c8862ae4305b7e7cd8dd8e4a8b98363", "logged_at": "2026-08-27T20:22:12.042Z", "timestamp": 1787862132042 } ], "newest_scanned_at": "2026-08-27T20:22:12.042Z", "oldest_scanned_at": "2026-08-27T20:20:44.118Z", "precertificate_count": 0, "scan_requested": 100, "scanned_from_index": 2750089298, "tree_size": 2750089398, "unreadable_entries": 0 } ``` ### Find logs for a certificate expiry date Given the day a certificate expires, say which logs could hold it. Certificate Transparency logs are sharded by year - Argon2026h2 only takes certificates expiring in the second half of 2026 - so asking the wrong shard returns nothing, correctly and misleadingly. Pick the expiry date off a certificate and this answers which logs to look in, grouped by operator so a check can be spread across several. No account or API key required. **Inputs** - Certificate expiry date (`expires_on`, date, required): The day the certificate expires - its 'not after' date. A full timestamp read off an earlier step works too; only the date is used. - States (`states`, text): Only logs in these states. A log's state is what says whether it is worth reading: browsers only trust certificates logged to a usable one, a retired log is frozen, and a rejected one failed qualification and proves nothing. Choose none to see every log. One or more of: `usable` (Usable - trusted, and taking new certificates), `qualified` (Qualified - passed its tests, being included), `pending` (Pending - has asked to be included), `readonly` (Read-only - frozen, but still readable), `retired` (Retired - no longer trusted for new certificates), `rejected` (Rejected - failed qualification), `unknown` (Unknown - the list gives no state (test and mirror logs)). - Log software (`log_type`, text): Only logs of this kind. RFC 6962 logs answer the original JSON API and are the only ones that serve proofs; tiled logs publish static files instead. Reading tree heads and entries works on either. One of: `any` (Either kind), `rfc6962` (RFC 6962 - the original API, and serves proofs), `tiled` (Tiled (static-ct-api) - the newer, static format). Default: `any`. - How many to return (`limit`, number): How many logs to return. The list holds about 120 logs in total, so the default of 50 covers every usable one. From 1 to 250. Default: `50`. **Outputs** - `expires_on` (text): The date asked about, as YYYY-MM-DD - `logs` (list): The logs that accept that expiry date - `match_count` (number): How many matched before the limit - `operator_count` (number): How many operators that is - `operators` (list): The operators running those logs - `returned` (number): How many logs came back - `source_url` (text): The Certificate Transparency project page - `states_filtered` (list): The states this was narrowed to **Example output** ```json { "expires_on": "2026-11-25", "logs": [ { "accepts_expiry_from": "2026-07-01T00:00:00Z", "accepts_expiry_until": "2027-01-01T00:00:00Z", "description": "Google 'Argon2026h2' log", "final_tree_size": null, "is_usable": true, "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=", "log_id_hex": "d76d7d10d1a7f577c2c7e95fd700bff982c9335a65e1d0b3017317c0c8c56977", "log_type": "rfc6962", "maximum_merge_delay_seconds": 86400, "monitoring_url": "https://ct.googleapis.com/logs/us1/argon2026h2/", "operator": "Google", "operator_emails": [ "google-ct-logs@googlegroups.com" ], "public_key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKjpni/66DIYrSlGK6Rf+e6F2c/28ZUvDJ79N81+gyimAESAyeNZ++TRgjHWg9TVQnKHTSU0T1TtqDupFnSQTIg==", "state": "usable", "state_since": "2024-09-30T22:19:27Z", "submission_url": "https://ct.googleapis.com/logs/us1/argon2026h2/", "url": "https://ct.googleapis.com/logs/us1/argon2026h2/" }, { "accepts_expiry_from": "2026-01-01T00:00:00Z", "accepts_expiry_until": "2027-01-01T00:00:00Z", "description": "Cloudflare 'Nimbus2026'", "final_tree_size": null, "is_usable": true, "log_id": "3e+CLnzhZlDPAHiy21ZK1AYxbb1JDU5Xz6y7tOSaOF0=", "log_id_hex": "ddef822e7ce16650cf0078b2db564ad406316dbd490d4e57cfacbbb4e49a385d", "log_type": "rfc6962", "maximum_merge_delay_seconds": 86400, "monitoring_url": "https://ct.cloudflare.com/logs/nimbus2026/", "operator": "Cloudflare", "operator_emails": [ "ct-logs@cloudflare.com" ], "public_key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE", "state": "usable", "state_since": "2023-05-23T20:00:00Z", "submission_url": "https://ct.cloudflare.com/logs/nimbus2026/", "url": "https://ct.cloudflare.com/logs/nimbus2026/" } ], "match_count": 16, "operator_count": 8, "operators": [ "Cloudflare", "Google" ], "returned": 2, "source_url": "https://certificate.transparency.dev", "states_filtered": [ "usable", "qualified" ] } ``` ### Get a log Read everything the published list says about one log: who runs it and how to contact them, its URL, its public key, its state and when it entered it, how long it may take to include a certificate it accepted, and the certificate expiry window it covers. Takes a log id, a description or a URL, so a log named by some other tool can be looked up here. No account or API key required. **Inputs** - Log (`log`, text, required): Which log to read. This dropdown offers every log the list names, retired and rejected ones included, with the state on each label - a retired log still holds everything it ever held. Typed by hand it takes a log id, a description, or the log's URL. **Outputs** - `accepts_expiry_from` (text): The first certificate expiry date this log accepts. Logs are sharded by year, so this is what decides whether a certificate could be in it at all - `accepts_expiry_until` (text): The first expiry date it no longer accepts (exclusive) - `description` (text): The log's name, e.g. "Google 'Argon2026h2' log" - `final_tree_size` (number): For a read-only log, the size it was frozen at; else null - `is_usable` (true/false): Whether it is usable or qualified, i.e. worth reading - `log_id` (text): The log's id: the SHA-256 of its public key, in base64 - `log_id_hex` (text): The same id in hex - `log_type` (text): 'rfc6962' or 'tiled' (static-ct-api) - `maximum_merge_delay_seconds` (number): How long the log may take to include a certificate it accepted - `monitoring_url` (text): The prefix a tiled log's checkpoint, tiles and issuers are read from; the same as the URL for an RFC 6962 log - `operator` (text): The organisation running it, e.g. 'Let's Encrypt' - `operator_emails` (list): Contact addresses the operator publishes - `public_key` (text): The log's public key, base64 DER, for verifying its signatures - `source_url` (text): The Certificate Transparency project page - `state` (text): 'usable', 'qualified', 'pending', 'readonly', 'retired' or 'rejected' - `state_since` (text): When it entered that state, ISO 8601 - `submission_url` (text): The prefix a CA submits certificates to - `url` (text): Where the log is reached **Example output** ```json { "accepts_expiry_from": "2026-07-01T00:00:00Z", "accepts_expiry_until": "2027-01-01T00:00:00Z", "description": "Google 'Argon2026h2' log", "final_tree_size": null, "is_usable": true, "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=", "log_id_hex": "d76d7d10d1a7f577c2c7e95fd700bff982c9335a65e1d0b3017317c0c8c56977", "log_type": "rfc6962", "maximum_merge_delay_seconds": 86400, "monitoring_url": "https://ct.googleapis.com/logs/us1/argon2026h2/", "operator": "Google", "operator_emails": [ "google-ct-logs@googlegroups.com" ], "public_key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKjpni/66DIYrSlGK6Rf+e6F2c/28ZUvDJ79N81+gyimAESAyeNZ++TRgjHWg9TVQnKHTSU0T1TtqDupFnSQTIg==", "source_url": "https://certificate.transparency.dev", "state": "usable", "state_since": "2024-09-30T22:19:27Z", "submission_url": "https://ct.googleapis.com/logs/us1/argon2026h2/", "url": "https://ct.googleapis.com/logs/us1/argon2026h2/" } ``` ### Get a log's newest entries Read the certificates a log has just taken, newest first, without working out any index: it reads the log's current size and takes the entries at the end of it. This is the live view of what the web PKI is issuing right now - every certificate any CA issues reaches a log within hours. Each entry is decoded into its domain names, issuer and validity. Works on either kind of log. No account or API key required. **Inputs** - Log (`log`, text, required): Which Certificate Transparency log to read. The dropdown lists the usable and qualified logs with the certificate expiry window each one covers, and stores the log's id rather than its name so a workflow keeps working when a log is renamed. Typed by hand it also takes a log id, a description as the log list writes it, or the log's URL. - How many entries (`count`, number): How many of the newest entries to read. Paged behind the scenes, since logs cap how much of a range they serve at once. From 1 to 100. Default: `10`. **Outputs** - `certificate_count` (number): How many of the returned entries are certificates - `distinct_issuers` (list): Which CAs issued them, most first - `dns_names` (list): Every DNS name across the returned entries, deduplicated - `entries` (list): The entries, newest first - `log` (object): Which log answered this - `precertificate_count` (number): How many are precertificates - `requested` (number): How many were asked for - `returned` (number): How many entries came back - `start_index` (number): The first entry read - `tree_head_published_at` (text): When the log signed that size; null for a tiled log - `tree_size` (number): How big the log was when this ran - `unreadable_entries` (number): How many could not be decoded **Example output** ```json { "certificate_count": 6, "distinct_issuers": [ { "count": 5, "issuer": "E7" }, { "count": 3, "issuer": "WE1" }, { "count": 2, "issuer": "ZeroSSL ECC DV SSL CA 2" } ], "dns_names": [ "shop.example.com", "www.shop.example.com" ], "entries": [ { "certificate": { "der_bytes": 1503, "dns_name_count": 2, "dns_names": [ "shop.example.com", "www.shop.example.com" ], "embedded_sct_count": 2, "embedded_scts": [ { "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=", "log_id_hex": "d76d7d10d1a7f577c2c7e95fd700bff982c9335a65e1d0b3017317c0c8c56977", "logged_at": "2026-08-27T20:22:12.042Z", "timestamp": 1787862132042 }, { "log_id": "3e+CLnzhZlDPAHiy21ZK1AYxbb1JDU5Xz6y7tOSaOF0=", "log_id_hex": "ddef822e7ce16650cf0078b2db564ad406316dbd490d4e57cfacbbb4e49a385d", "logged_at": "2026-08-27T20:22:10.118Z", "timestamp": 1787862130118 } ], "fingerprint_sha256": "4973b48cf244e4981d43ff0485c347d50a22f0b827f9d0c96f9233a9e7646bf5", "fingerprint_sha256_base64": "SXO0jPJE5JgdQ/8EhcNH1Qoi8Lgn+dDJb5Izqedka/U=", "ip_addresses": [], "is_ca": false, "is_precertificate": false, "issuer": "C=US, O=Let's Encrypt, CN=E7", "issuer_country": "US", "issuer_name": "E7", "issuer_organization": "Let's Encrypt", "not_after": "2026-11-25T19:23:40Z", "not_before": "2026-08-27T19:23:41Z", "serial_number": "05eebb1d605d88f2cefb2343c4c80009817b", "subject": "CN=shop.example.com", "subject_common_name": "shop.example.com", "subject_organization": "", "validity_days": 90.0, "version": 3 }, "chain_fingerprints": [ "a2372d06431e9716365eeed47ec020351497d182fcc038e457e58168a03cac07", "349dfa4058c5e263123b398ae795573c4e1313c83fe68f93556cd5e8031b3c7d" ], "chain_length": 2, "entry_type": "x509_entry", "index": 2750089397, "issuer_key_hash": null, "leaf_hash": "Ovw+MVXYy6mDh1kBu6RhbAyIYq5DBbfnzY3Y5Ki5g2M=", "leaf_hash_hex": "3afc3e3155d8cba983875901bba4616c0c8862ae4305b7e7cd8dd8e4a8b98363", "logged_at": "2026-08-27T20:22:12.042Z", "timestamp": 1787862132042 } ], "log": { "description": "Google 'Argon2026h2' log", "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=", "log_type": "rfc6962", "operator": "Google", "state": "usable", "url": "https://ct.googleapis.com/logs/us1/argon2026h2/" }, "precertificate_count": 4, "requested": 10, "returned": 10, "start_index": 2750089388, "tree_head_published_at": "2026-08-27T20:36:26.837Z", "tree_size": 2750089398, "unreadable_entries": 0 } ``` ### Get a log's tree head Read how big a log is right now and the root hash that commits to everything in it. This is a log's heartbeat: the tree size says how many certificates it holds, and the root hash is what every proof is checked against. Record both to check later that nothing already published has changed. Works on either kind of log - it reads a signed tree head from an RFC 6962 log and a checkpoint from a tiled one - so a workflow does not have to know which it got. No account or API key required. **Inputs** - Log (`log`, text, required): Which log to read. This dropdown offers every log the list names, retired and rejected ones included, with the state on each label - a retired log still holds everything it ever held. Typed by hand it takes a log id, a description, or the log's URL. **Outputs** - `age_seconds` (number): How long ago that was; a healthy log signs a fresh one every few minutes. Null for a tiled log - `log` (object): Which log answered this - `maximum_merge_delay_seconds` (number): How long the log may take to include something it accepted - `published_at` (text): The same moment as ISO 8601, or null - `root_hash` (text): The Merkle root committing to all of them, base64 - `root_hash_hex` (text): The same root hash in hex - `signature` (text): The log's signature over the tree head - `signature_count` (number): How many signatures it carries; a tiled log's checkpoint is also signed by independent witnesses - `source` (text): 'get-sth' or 'checkpoint' - `timestamp` (number): When the log signed it, epoch milliseconds; null for a tiled log, whose checkpoint carries no time - `tree_size` (number): How many entries the log holds **Example output** ```json { "age_seconds": 60.2, "log": { "description": "Google 'Argon2026h2' log", "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=", "log_type": "rfc6962", "operator": "Google", "state": "usable", "url": "https://ct.googleapis.com/logs/us1/argon2026h2/" }, "maximum_merge_delay_seconds": 86400, "published_at": "2026-08-27T20:36:26.837Z", "root_hash": "7UlsX+cWAfvm+yRpz9z7CFEDg3Jd3Txoce0LJrtFrpk=", "root_hash_hex": "ed496c5fe71601fbe6fb2469cfdcfb08510383725ddd3c6871ed0b26bb45ae99", "signature": "BAMARjBEAiBw/VV5S3oX+67s8gZs1cj8WoCyLBo1zu1phkZLJ/3Jsg==", "signature_count": 1, "source": "get-sth", "timestamp": 1787862986837, "tree_size": 2750089398 } ``` ### Get a tiled log's checkpoint Read a tiled log's checkpoint in full: the signed note it publishes in place of a signed tree head, with its origin line, its size, its root hash and every signature on it - including the independent witnesses that co-sign it, which is what makes a tiled log's word harder to take back. Use 'Get a log's tree head' when all that is wanted is the size and the root; use this when the signatures themselves matter. Only tiled logs serve it. No account or API key required. **Inputs** - Log (`log`, text, required): Which tiled log to read. Only tiled (static-ct-api) logs serve this, so the dropdown offers those. Two thirds of the logs in the list are now tiled. **Outputs** - `extension_lines` (list): Any extra body lines the note carries - `log` (object): Which log answered this - `origin` (text): The name the log signs under, usually its hostname - `raw` (text): The checkpoint exactly as served - `root_hash` (text): The Merkle root hash, base64 - `root_hash_hex` (text): The same root hash in hex - `signature_count` (number): How many signatures that is - `signature_lines` (list): Every signature line, as written: the log's own first, then any witnesses' - `tree_size` (number): How many entries it holds **Example output** ```json { "extension_lines": [], "log": { "description": "Google 'ParcelYard2026h2' log", "log_id": "utuIpG+cr6QJDoLlk1bbbni0pT9YLbCBl5UkLym2jJg=", "log_type": "tiled", "operator": "Google", "state": "qualified", "url": "https://parcelyard2026h2.prod.certificate.transparency.goog/" }, "origin": "parcelyard2026h2.prod.certificate.transparency.goog", "raw": "parcelyard2026h2.prod.certificate.transparency.goog\n1073943772\nkZ2nCJ1Lhp6xsRThmBTWVVOxOBk4Q3D1HXB/dtykVNY=\n", "root_hash": "kZ2nCJ1Lhp6xsRThmBTWVVOxOBk4Q3D1HXB/dtykVNY=", "root_hash_hex": "919da7089d4b869eb1b114e19814d65553b13819384370f51d707f76dca454d6", "signature_count": 4, "signature_lines": [ "\u2014 parcelyard2026h2.prod.certificate.transparency.goog k6eK4AAA", "\u2014 witness.navigli.sunlight.geomys.org o+AP4gAAAABqkJ50IrG0u4At" ], "tree_size": 1073943772 } ``` ### Get an entry with its proof Read the entry at a given position and prove it is in the log, in one call. The certificate comes back decoded and the proof is checked against the log's current root, so a workflow can quote a certificate and say in the same breath that the log stands behind it. Only RFC 6962 logs serve this. No account or API key required. **Inputs** - Log (`log`, text, required): Which log to ask for the proof. Only RFC 6962 logs serve proofs, so this dropdown offers those; a tiled log builds proofs from its hash tiles instead of answering for them. - Entry number (`leaf_index`, number, required): Which entry to read, counting from zero. The last entry's number is one less than the log's size. At least 0. - Tree size to prove against (`tree_size`, number): The size of the tree the proof should be made for. Leave empty to use the log's current size, which is the usual case and the only one this can verify for you - an older size can be asked for, but its root hash is not published anywhere, so the proof comes back unchecked. At least 1. **Outputs** - `audit_path` (list): The sibling hashes proving it, base64 - `audit_path_length` (number): How many hashes that is - `current_tree_size` (number): How big the log is now - `entry` (object): The entry at that position, decoded - `leaf_index` (number): The entry number read - `log` (object): Which log answered this - `tree_size` (number): The tree size the proof was made for - `verified` (true/false): Whether the proof checked out against the log's current root; null when asked for at an older size - `verified_against_root_hash` (text): The root hash it was checked against **Example output** ```json { "audit_path": [ "zUprTGcJYOBkfViwX6OlVgwioJEyl0zrXek7vT7uBrw=" ], "audit_path_length": 22, "current_tree_size": 2750090248, "entry": { "certificate": { "der_bytes": 1503, "dns_name_count": 2, "dns_names": [ "shop.example.com", "www.shop.example.com" ], "embedded_sct_count": 2, "embedded_scts": [ { "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=", "log_id_hex": "d76d7d10d1a7f577c2c7e95fd700bff982c9335a65e1d0b3017317c0c8c56977", "logged_at": "2026-08-27T20:22:12.042Z", "timestamp": 1787862132042 }, { "log_id": "3e+CLnzhZlDPAHiy21ZK1AYxbb1JDU5Xz6y7tOSaOF0=", "log_id_hex": "ddef822e7ce16650cf0078b2db564ad406316dbd490d4e57cfacbbb4e49a385d", "logged_at": "2026-08-27T20:22:10.118Z", "timestamp": 1787862130118 } ], "fingerprint_sha256": "4973b48cf244e4981d43ff0485c347d50a22f0b827f9d0c96f9233a9e7646bf5", "fingerprint_sha256_base64": "SXO0jPJE5JgdQ/8EhcNH1Qoi8Lgn+dDJb5Izqedka/U=", "ip_addresses": [], "is_ca": false, "is_precertificate": false, "issuer": "C=US, O=Let's Encrypt, CN=E7", "issuer_country": "US", "issuer_name": "E7", "issuer_organization": "Let's Encrypt", "not_after": "2026-11-25T19:23:40Z", "not_before": "2026-08-27T19:23:41Z", "serial_number": "05eebb1d605d88f2cefb2343c4c80009817b", "subject": "CN=shop.example.com", "subject_common_name": "shop.example.com", "subject_organization": "", "validity_days": 90.0, "version": 3 }, "chain_fingerprints": [ "a2372d06431e9716365eeed47ec020351497d182fcc038e457e58168a03cac07", "349dfa4058c5e263123b398ae795573c4e1313c83fe68f93556cd5e8031b3c7d" ], "chain_length": 2, "entry_type": "x509_entry", "index": 2750089397, "issuer_key_hash": null, "leaf_hash": "Ovw+MVXYy6mDh1kBu6RhbAyIYq5DBbfnzY3Y5Ki5g2M=", "leaf_hash_hex": "3afc3e3155d8cba983875901bba4616c0c8862ae4305b7e7cd8dd8e4a8b98363", "logged_at": "2026-08-27T20:22:12.042Z", "timestamp": 1787862132042 }, "leaf_index": 2750089397, "log": { "description": "Google 'Argon2026h2' log", "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=", "log_type": "rfc6962", "operator": "Google", "state": "usable", "url": "https://ct.googleapis.com/logs/us1/argon2026h2/" }, "tree_size": 2750090248, "verified": true, "verified_against_root_hash": "7UlsX+cWAfvm+yRpz9z7CFEDg3Jd3Txoce0LJrtFrpk=" } ``` ### Get an issuer certificate Fetch one of the CA certificates a tiled log stores, by its SHA-256 fingerprint, decoded and also as PEM ready to paste into another tool. A tiled log's entries name their issuing chain by fingerprint rather than carrying it, so this is how the intermediate that signed a certificate is read - take a fingerprint from an entry's chain and look it up here. A log stores only the CA certificates it has actually been shown. No account or API key required. **Inputs** - Log (`log`, text, required): Which tiled log to read. Only tiled (static-ct-api) logs serve this, so the dropdown offers those. Two thirds of the logs in the list are now tiled. - Certificate fingerprint (`fingerprint`, text, required): The SHA-256 fingerprint of the CA certificate to fetch, as 64 hex characters or the same bytes in base64. Entries returned by this integration carry their chain's fingerprints ready to use. **Outputs** - `certificate` (object): The CA certificate, decoded - `certificate_pem` (text): The same certificate as PEM, for pasting into another tool - `fingerprint` (text): The fingerprint fetched, in hex - `log` (object): Which log answered this **Example output** ```json { "certificate": { "der_bytes": 1391, "dns_name_count": 0, "dns_names": [], "embedded_sct_count": 0, "embedded_scts": [], "fingerprint_sha256": "96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6", "fingerprint_sha256_base64": "lrzsBiZJdvN0YHeazyjFp8/oo8Cq4RqP/O4FwL3fCMY=", "ip_addresses": [], "is_ca": true, "is_precertificate": false, "issuer": "C=US, O=Internet Security Research Group, CN=ISRG Root X1", "issuer_country": "US", "issuer_name": "ISRG Root X1", "issuer_organization": "Internet Security Research Group", "not_after": "2035-06-04T11:04:38Z", "not_before": "2015-06-04T11:04:38Z", "serial_number": "0a0142800000014523c844b500000002", "subject": "C=US, O=Internet Security Research Group, CN=ISRG Root X1", "subject_common_name": "ISRG Root X1", "subject_organization": "Internet Security Research Group", "validity_days": 7305.0, "version": 3 }, "certificate_pem": "-----BEGIN CERTIFICATE-----\nMIIFYDCCBEigAwIBAgIQQAF3\n-----END CERTIFICATE-----", "fingerprint": "1dfc1605fbad358d8bc844f76d15203fac9ca5c1a79fd4857ffaf2864fbebf96", "log": { "description": "Google 'ParcelYard2026h2' log", "log_id": "utuIpG+cr6QJDoLlk1bbbni0pT9YLbCBl5UkLym2jJg=", "log_type": "tiled", "operator": "Google", "state": "qualified", "url": "https://parcelyard2026h2.prod.certificate.transparency.goog/" } } ``` ### Get entries from a log Read a range of a log's entries and decode the certificate in each one: the domain names it covers, who issued it, when it was issued and when it expires, its fingerprint, and the signed timestamps its CA embedded. Entries are numbered from zero and never move, so a workflow can pick up exactly where it left off. Works on either kind of log. No account or API key required. **Inputs** - Log (`log`, text, required): Which Certificate Transparency log to read. The dropdown lists the usable and qualified logs with the certificate expiry window each one covers, and stores the log's id rather than its name so a workflow keeps working when a log is renamed. Typed by hand it also takes a log id, a description as the log list writes it, or the log's URL. - Start at entry (`start_index`, number, required): The first entry to read, counting from zero. Entry numbers never change, so the end index of a previous run plus one carries on from where it stopped. At least 0. - How many entries (`count`, number): How many entries to read. Logs cap how much of a range they will serve in one answer - Google's return 32 - so this is paged behind the scenes until the count is met. From 1 to 100. Default: `10`. **Outputs** - `certificate_count` (number): How many of the returned entries are certificates - `distinct_issuers` (list): Which CAs issued them, most first - `dns_names` (list): Every DNS name across the returned entries, deduplicated - `end_index` (number): The last entry read; add one to continue from here - `entries` (list): The entries, oldest first - `log` (object): Which log answered this - `precertificate_count` (number): How many are precertificates - `requested` (number): How many were asked for - `returned` (number): How many entries came back - `start_index` (number): The first entry read - `unreadable_entries` (number): How many could not be decoded; normally zero **Example output** ```json { "certificate_count": 6, "distinct_issuers": [ { "count": 5, "issuer": "E7" }, { "count": 3, "issuer": "WE1" }, { "count": 2, "issuer": "ZeroSSL ECC DV SSL CA 2" } ], "dns_names": [ "shop.example.com", "www.shop.example.com" ], "end_index": 2750089397, "entries": [ { "certificate": { "der_bytes": 1503, "dns_name_count": 2, "dns_names": [ "shop.example.com", "www.shop.example.com" ], "embedded_sct_count": 2, "embedded_scts": [ { "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=", "log_id_hex": "d76d7d10d1a7f577c2c7e95fd700bff982c9335a65e1d0b3017317c0c8c56977", "logged_at": "2026-08-27T20:22:12.042Z", "timestamp": 1787862132042 }, { "log_id": "3e+CLnzhZlDPAHiy21ZK1AYxbb1JDU5Xz6y7tOSaOF0=", "log_id_hex": "ddef822e7ce16650cf0078b2db564ad406316dbd490d4e57cfacbbb4e49a385d", "logged_at": "2026-08-27T20:22:10.118Z", "timestamp": 1787862130118 } ], "fingerprint_sha256": "4973b48cf244e4981d43ff0485c347d50a22f0b827f9d0c96f9233a9e7646bf5", "fingerprint_sha256_base64": "SXO0jPJE5JgdQ/8EhcNH1Qoi8Lgn+dDJb5Izqedka/U=", "ip_addresses": [], "is_ca": false, "is_precertificate": false, "issuer": "C=US, O=Let's Encrypt, CN=E7", "issuer_country": "US", "issuer_name": "E7", "issuer_organization": "Let's Encrypt", "not_after": "2026-11-25T19:23:40Z", "not_before": "2026-08-27T19:23:41Z", "serial_number": "05eebb1d605d88f2cefb2343c4c80009817b", "subject": "CN=shop.example.com", "subject_common_name": "shop.example.com", "subject_organization": "", "validity_days": 90.0, "version": 3 }, "chain_fingerprints": [ "a2372d06431e9716365eeed47ec020351497d182fcc038e457e58168a03cac07", "349dfa4058c5e263123b398ae795573c4e1313c83fe68f93556cd5e8031b3c7d" ], "chain_length": 2, "entry_type": "x509_entry", "index": 2750089397, "issuer_key_hash": null, "leaf_hash": "Ovw+MVXYy6mDh1kBu6RhbAyIYq5DBbfnzY3Y5Ki5g2M=", "leaf_hash_hex": "3afc3e3155d8cba983875901bba4616c0c8862ae4305b7e7cd8dd8e4a8b98363", "logged_at": "2026-08-27T20:22:12.042Z", "timestamp": 1787862132042 } ], "log": { "description": "Google 'Argon2026h2' log", "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=", "log_type": "rfc6962", "operator": "Google", "state": "usable", "url": "https://ct.googleapis.com/logs/us1/argon2026h2/" }, "precertificate_count": 4, "requested": 10, "returned": 10, "start_index": 2750089388, "unreadable_entries": 0 } ``` ### List Certificate Transparency logs List the Certificate Transparency logs, from the same published list Chrome itself uses. Each one comes back with who runs it, its URL, its state, whether it speaks the RFC 6962 API or the newer tiled format, and - the part that usually decides which log to read - the window of certificate expiry dates it accepts, because logs are sharded by year. Filter by state, by operator, by kind, or by a word in the name. Start here when a workflow needs to pick a log. No account or API key required. **Inputs** - States (`states`, text): Only logs in these states. A log's state is what says whether it is worth reading: browsers only trust certificates logged to a usable one, a retired log is frozen, and a rejected one failed qualification and proves nothing. Choose none to see every log. One or more of: `usable` (Usable - trusted, and taking new certificates), `qualified` (Qualified - passed its tests, being included), `pending` (Pending - has asked to be included), `readonly` (Read-only - frozen, but still readable), `retired` (Retired - no longer trusted for new certificates), `rejected` (Rejected - failed qualification), `unknown` (Unknown - the list gives no state (test and mirror logs)). - Operator (`operator`, text): Only logs run by this organisation. Leave empty for all of them. - Log software (`log_type`, text): Only logs of this kind. RFC 6962 logs answer the original JSON API and are the only ones that serve proofs; tiled logs publish static files instead. Reading tree heads and entries works on either. One of: `any` (Either kind), `rfc6962` (RFC 6962 - the original API, and serves proofs), `tiled` (Tiled (static-ct-api) - the newer, static format). Default: `any`. - Search for (`query`, text): Only logs whose name, URL or operator contains this text, matched without regard to case. Leave empty for all of them. - Sort by (`sort_by`, text): What order the logs come back in. One of: `operator` (Operator, then log name), `description` (Log name), `state` (State, most useful first), `expiry_window` (The expiry window the log covers). Default: `operator`. - How many to return (`limit`, number): How many logs to return. The list holds about 120 logs in total, so the default of 50 covers every usable one. From 1 to 250. Default: `50`. **Outputs** - `log_list_updated_at` (text): When that version was published - `log_list_version` (text): The version of the published list read - `logs` (list): The matching logs, capped by the limit - `match_count` (number): How many matched before the limit - `returned` (number): How many logs came back - `source_url` (text): The Certificate Transparency project page - `states_filtered` (list): The states asked for, if any - `total_logs` (number): How many logs were in the list this read: the shorter published list unless retired or rejected logs were asked for, in which case the full one **Example output** ```json { "log_list_updated_at": "2026-08-27T13:36:56Z", "log_list_version": "89.32", "logs": [ { "accepts_expiry_from": "2026-07-01T00:00:00Z", "accepts_expiry_until": "2027-01-01T00:00:00Z", "description": "Google 'Argon2026h2' log", "final_tree_size": null, "is_usable": true, "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=", "log_id_hex": "d76d7d10d1a7f577c2c7e95fd700bff982c9335a65e1d0b3017317c0c8c56977", "log_type": "rfc6962", "maximum_merge_delay_seconds": 86400, "monitoring_url": "https://ct.googleapis.com/logs/us1/argon2026h2/", "operator": "Google", "operator_emails": [ "google-ct-logs@googlegroups.com" ], "public_key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKjpni/66DIYrSlGK6Rf+e6F2c/28ZUvDJ79N81+gyimAESAyeNZ++TRgjHWg9TVQnKHTSU0T1TtqDupFnSQTIg==", "state": "usable", "state_since": "2024-09-30T22:19:27Z", "submission_url": "https://ct.googleapis.com/logs/us1/argon2026h2/", "url": "https://ct.googleapis.com/logs/us1/argon2026h2/" }, { "accepts_expiry_from": "2026-01-01T00:00:00Z", "accepts_expiry_until": "2027-01-01T00:00:00Z", "description": "Cloudflare 'Nimbus2026'", "final_tree_size": null, "is_usable": true, "log_id": "3e+CLnzhZlDPAHiy21ZK1AYxbb1JDU5Xz6y7tOSaOF0=", "log_id_hex": "ddef822e7ce16650cf0078b2db564ad406316dbd490d4e57cfacbbb4e49a385d", "log_type": "rfc6962", "maximum_merge_delay_seconds": 86400, "monitoring_url": "https://ct.cloudflare.com/logs/nimbus2026/", "operator": "Cloudflare", "operator_emails": [ "ct-logs@cloudflare.com" ], "public_key": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE", "state": "usable", "state_since": "2023-05-23T20:00:00Z", "submission_url": "https://ct.cloudflare.com/logs/nimbus2026/", "url": "https://ct.cloudflare.com/logs/nimbus2026/" } ], "match_count": 43, "returned": 2, "source_url": "https://certificate.transparency.dev", "states_filtered": [ "usable" ], "total_logs": 122 } ``` ### List log operators List the organisations that run Certificate Transparency logs - Google, Cloudflare, Let's Encrypt, DigiCert, Sectigo and the rest - with how many logs each runs, how many of those are usable, how they split between the two log formats, and the contact addresses they publish. Useful for spreading monitoring across operators, which is the point of having several. No account or API key required. **Inputs** - Count retired and rejected logs too (`include_all_logs`, true/false): Off by default, so the counts describe the logs worth reading. Turn it on to count every log an operator has ever run. Default: `false`. **Outputs** - `includes_retired_and_rejected` (true/false): Whether retired and rejected logs were counted - `log_count` (number): How many logs they run between them - `operator_count` (number): How many operators there are - `operators` (list): The operators, those running most usable logs first - `source_url` (text): The Certificate Transparency project page **Example output** ```json { "includes_retired_and_rejected": false, "log_count": 48, "operator_count": 8, "operators": [ { "emails": [ "google-ct-logs@googlegroups.com" ], "log_count": 10, "log_descriptions": [ "Google 'Argon2026h2' log" ], "name": "Google", "rfc6962_log_count": 6, "tiled_log_count": 4, "usable_log_count": 10 }, { "emails": [ "ct-logs@letsencrypt.org" ], "log_count": 7, "log_descriptions": [ "Let's Encrypt 'Oak2026h2'" ], "name": "Let's Encrypt", "rfc6962_log_count": 4, "tiled_log_count": 3, "usable_log_count": 6 } ], "source_url": "https://certificate.transparency.dev" } ``` ### List the roots a log accepts List the CA root certificates a log will accept chains up to, each decoded into its subject, its issuer, its validity dates and its SHA-256 fingerprint. A typical log accepts several hundred. Use it to check whether a particular CA can log to a particular log at all, or to take a fingerprint to look a certificate up with. Filter by any text in the subject or issuer. No account or API key required. **Inputs** - Log (`log`, text, required): Which Certificate Transparency log to read. The dropdown lists the usable and qualified logs with the certificate expiry window each one covers, and stores the log's id rather than its name so a workflow keeps working when a log is renamed. Typed by hand it also takes a log id, a description as the log list writes it, or the log's URL. - Search for (`query`, text): Only roots whose subject or issuer contains this text, matched without regard to case. Leave empty for all of them. - How many to return (`limit`, number): How many roots to return. The default of 25 keeps a step's result readable; a log accepts several hundred, so raise it when a later step needs the whole set. From 1 to 1000. Default: `25`. **Outputs** - `log` (object): Which log answered this - `match_count` (number): How many matched before the limit - `returned` (number): How many roots came back - `roots` (list): The matching root certificates, by name - `total_roots` (number): How many roots the log accepts in all - `unreadable_roots` (number): How many the log sent that could not be decoded; normally zero **Example output** ```json { "log": { "description": "Google 'Argon2026h2' log", "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=", "log_type": "rfc6962", "operator": "Google", "state": "usable", "url": "https://ct.googleapis.com/logs/us1/argon2026h2/" }, "match_count": 1, "returned": 1, "roots": [ { "der_bytes": 1391, "dns_name_count": 0, "dns_names": [], "embedded_sct_count": 0, "embedded_scts": [], "fingerprint_sha256": "96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6", "fingerprint_sha256_base64": "lrzsBiZJdvN0YHeazyjFp8/oo8Cq4RqP/O4FwL3fCMY=", "ip_addresses": [], "is_ca": true, "is_precertificate": false, "issuer": "C=US, O=Internet Security Research Group, CN=ISRG Root X1", "issuer_country": "US", "issuer_name": "ISRG Root X1", "issuer_organization": "Internet Security Research Group", "not_after": "2035-06-04T11:04:38Z", "not_before": "2015-06-04T11:04:38Z", "serial_number": "0a0142800000014523c844b500000002", "subject": "C=US, O=Internet Security Research Group, CN=ISRG Root X1", "subject_common_name": "ISRG Root X1", "subject_organization": "Internet Security Research Group", "validity_days": 7305.0, "version": 3 } ], "total_roots": 669, "unreadable_roots": 0 } ``` ### Prove a log has only appended Ask a log to prove that everything it published at an earlier size is still there, unchanged, in the log as it is now. This is the check that makes a transparency log worth the name, and it is what monitoring one looks like: record a tree head's size and root hash today, hand both back tomorrow, and get a yes or a no. Without the earlier root hash the proof is still returned, but nothing can be checked against it. Only RFC 6962 logs serve proofs. No account or API key required. **Inputs** - Log (`log`, text, required): Which log to ask for the proof. Only RFC 6962 logs serve proofs, so this dropdown offers those; a tiled log builds proofs from its hash tiles instead of answering for them. - Earlier tree size (`first_size`, number, required): The size the log was when you last looked. Take it from a tree head you recorded. At least 1. - Earlier root hash (`first_root_hash`, text): The root hash the log reported at that size. Supply it and the proof is verified for you; leave it empty and the proof comes back unchecked, because a log does not publish its own history. Base64 or hex. - Later tree size (`second_size`, number): The size to compare against. Leave empty for the log's current size, which is the only one whose root hash is published and so the only one this can verify against. At least 1. **Outputs** - `current_tree_size` (number): How big the log is now - `entries_added` (number): How many entries were added in between - `first_root_hash` (text): The earlier root hash that was supplied, or null - `first_size` (number): The earlier size compared from - `is_current` (true/false): Whether the later size is the log's current size - `log` (object): Which log answered this - `not_verified_because` (text): Why nothing was checked, when nothing was - `proof` (list): The proof's node hashes, base64 - `proof_length` (number): How many hashes that is - `second_root_hash` (text): The later root hash, when the later size is the current one; null otherwise - `second_size` (number): The later size compared to - `verified` (true/false): True when the proof connects both roots, false when it does not, null when there was not enough to check it with **Example output** ```json { "current_tree_size": 2750092323, "entries_added": 6, "first_root_hash": "7UlsX+cWAfvm+yRpz9z7CFEDg3Jd3Txoce0LJrtFrpk=", "first_size": 2750092317, "is_current": true, "log": { "description": "Google 'Argon2026h2' log", "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=", "log_type": "rfc6962", "operator": "Google", "state": "usable", "url": "https://ct.googleapis.com/logs/us1/argon2026h2/" }, "not_verified_because": null, "proof": [ "zUprTGcJYOBkfViwX6OlVgwioJEyl0zrXek7vT7uBrw=" ], "proof_length": 19, "second_root_hash": "NB0qoL7oMjWNb6/3NT5QsrYsIf9zuQaJeUhp+0hndnU=", "second_size": 2750092323, "verified": true } ``` ### Prove an entry is in a log Ask a log to prove that an entry really is in it, and check the proof. Give it the leaf hash any entry-reading action returns; the log answers with the hashes that connect that entry to its root, and those are recomputed here against the log's own current root hash. A true answer is the log's commitment made good; a false one means what the log said does not add up. Only RFC 6962 logs serve proofs. No account or API key required. **Inputs** - Log (`log`, text, required): Which log to ask for the proof. Only RFC 6962 logs serve proofs, so this dropdown offers those; a tiled log builds proofs from its hash tiles instead of answering for them. - Entry's leaf hash (`leaf_hash`, text, required): The Merkle leaf hash of the entry to prove, which every entry this integration returns carries as 'leaf_hash'. Base64 or hex. - Tree size to prove against (`tree_size`, number): The size of the tree the proof should be made for. Leave empty to use the log's current size, which is the usual case and the only one this can verify for you - an older size can be asked for, but its root hash is not published anywhere, so the proof comes back unchecked. At least 1. **Outputs** - `audit_path` (list): The sibling hashes that connect the entry to the root, base64, from the leaf upwards - `audit_path_length` (number): How many hashes that is - `current_tree_size` (number): How big the log is now - `leaf_hash` (text): The leaf hash asked about, base64 - `leaf_index` (number): Where the log says that entry sits - `log` (object): Which log answered this - `tree_size` (number): The tree size the proof was made for - `verified` (true/false): Whether recomputing the root from the entry and the path matched the log's own root. Null when the proof was asked for at an older tree size, whose root is not published - `verified_against_root_hash` (text): The root hash it was checked against **Example output** ```json { "audit_path": [ "zUprTGcJYOBkfViwX6OlVgwioJEyl0zrXek7vT7uBrw=", "7zWBMNkajvykvRUsmNjKqB7asXpjyuKi0Nw3ROBguz0=" ], "audit_path_length": 21, "current_tree_size": 2750090137, "leaf_hash": "Ovw+MVXYy6mDh1kBu6RhbAyIYq5DBbfnzY3Y5Ki5g2M=", "leaf_index": 2750089397, "log": { "description": "Google 'Argon2026h2' log", "log_id": "1219ENGn9XfCx+lf1wC/+YLJM1pl4dCzAXMXwMjFaXc=", "log_type": "rfc6962", "operator": "Google", "state": "usable", "url": "https://ct.googleapis.com/logs/us1/argon2026h2/" }, "tree_size": 2750090137, "verified": true, "verified_against_root_hash": "7UlsX+cWAfvm+yRpz9z7CFEDg3Jd3Txoce0LJrtFrpk=" } ``` ### Summarize the log list Read which version of the published Certificate Transparency log list is current, when it was published, and what it holds: how many logs there are in each state, how they split between the RFC 6962 and tiled formats, how many operators run them, and the range of certificate expiry dates the logs cover between them. Run it to check for a new version of the list before doing anything else. No account or API key required. **Inputs**: None. **Outputs** - `earliest_expiry_window_start` (text): The earliest expiry date any log accepts - `latest_expiry_window_end` (text): The latest expiry date any log accepts - `log_list_url` (text): Where the list was read from - `logs_by_state` (list): The same counts as rows, largest first - `operator_count` (number): How many organisations run them - `pending_logs` (number): How many are pending - `qualified_logs` (number): How many are qualified - `readonly_logs` (number): How many are read-only - `rejected_logs` (number): How many were rejected - `retired_logs` (number): How many are retired - `rfc6962_logs` (number): How many speak the RFC 6962 API - `source_url` (text): The Certificate Transparency project page - `tiled_logs` (number): How many are tiled (static-ct-api) logs - `total_logs` (number): How many logs it names in all - `updated_at` (text): When it was published, ISO 8601 - `usable_logs` (number): How many are usable - `version` (text): The list's version, e.g. '89.32' **Example output** ```json { "earliest_expiry_window_start": "2020-01-01T08:00:00Z", "latest_expiry_window_end": "2029-01-01T00:00:00Z", "log_list_url": "https://www.gstatic.com/ct/log_list/v3/log_list.json", "logs_by_state": [ { "count": 37, "state": "usable" }, { "count": 21, "state": "pending" }, { "count": 14, "state": "rejected" } ], "operator_count": 10, "pending_logs": 21, "qualified_logs": 6, "readonly_logs": 2, "rejected_logs": 14, "retired_logs": 3, "rfc6962_logs": 42, "source_url": "https://certificate.transparency.dev", "tiled_logs": 80, "total_logs": 122, "updated_at": "2026-08-27T13:36:56Z", "usable_logs": 37, "version": "89.32" } ```