Certificate Transparency
Find every TLS certificate for your domain with Certificate Transparency
Publicly trusted certificate authorities write issued certificates to public logs. Certwatch reads those logs for the domains you add and stores what they return. "Every" means the issuances those logs return for that name, not a guarantee of every private certificate or every certificate that expired before the first read.
What you add
Sign in with a one-time email link, create an organization, and name a domain you run. Owners and admins can add more domains and invite people. Viewers can read the inventory and export CSV. Each organization's certificates are private to its members. The only inventory available without an account is the mozilla.org demo.
What gets stored
A scheduler runs every 5 minutes and only queues work. A queue consumer reads one page per message. Cert Spotter is tried first. crt.sh is the fallback when a domain has no certificates stored yet. Certwatch stores names, issuer, serial, not-before, not-after, key information, signature algorithm, source, and a fingerprint when the log includes the certificate. Daily caps can pause that work until the next UTC day. The dashboard then says Paused for budget.
You do not paste certificate files in. Certwatch does not need a server login, a DNS change, or a file on the host to build this inventory. The logs are already public.
A logged certificate may not be installed
The logs record that a certificate was issued. They do not record that you installed it, that you are still serving it, or that you meant to request it. Someone can obtain a certificate for a name you control, and that issuance can appear here. To see the certificate a host is actually serving, add an endpoint. That comparison is described on renewed but not deployed.
Expiry highlighting for these rows is covered under certificate expiry monitoring.