Crt.sh

Crt.sh is a certificate transparency log search and monitoring platform that provides comprehensive access to SSL/TLS certificates recorded in public certificate transparency (CT) logs. This service enables security researchers, domain administrators, penetration testers, and compliance teams to discover, monitor, and analyze digital certificates issued for any domain or organization across the internet.

Category	Threat intelligence
Direction	Query source
Sign-in	No Authentication
Query languages	SQLite
Tables	5
Query templates	24
Website	crt.sh

Before you start

Crt.sh needs no credentials — Huntbase queries it without signing in.

Connect Crt.sh

1. Go to Connections and click New connection, or click New connection on the Crt.sh product page.
2. On Product, pick Crt.sh and choose the Owner.
3. On Details, give the connection a Name and, optionally, a Description.
4. On Connect, fill in the settings and credentials described below.
5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Credentials

The only Method is No Authentication. Enter a Credential label (for example Production), then fill in:

No fields — choose this method to connect without credentials.

Query it

Once connected, Crt.sh can serve these languages in a query tab, and Scout can use it when you ask in Auto:

Language	Use it for
SQLite	SQL over the 5 tables listed below, alongside every other connected source.

Example: SQLite

Inactive CA Issuers — Discover the segments that consist of Certificate Authority (CA) issuers that are currently inactive.

SELECT
  ca_id,
  url,
  result,
  is_active
FROM
  crtsh_ca_issuer
WHERE
  is_active = 0;

Crt.sh ships with 24 query templates. Find them in Library › Queries — see Query templates.

Tables

Crt.sh adds 5 tables. Browse their columns from Schema in the query bar's ⋯ menu.

All 5 tables

Table	Contains
crtsh_ca	Certificate authorities.
crtsh_ca_issuer	Certificate Authority Issuers (certificate URLs) known to crt.sh, including the status of their last check.
crtsh_certificate	Certificates recorded in transparency logs.
crtsh_log	Certificate transparency log operators.
crtsh_log_entry	Certificate transparency log entries recorded for each certificate.

Next steps

• Connections — health, credentials and settings after you connect
• Query languages — syntax, parameters and time ranges
• Chatting with Scout — ask questions without writing a query
• All integrations — the rest of the catalog