Certificate Transparency
Find every TLS certificate for your domain with Certificate Transparency
Publicly trusted certificate authorities write issued certificates to public logs. CertLantern reads those logs for the domains you add and stores what they return. "Every" means the issuances those logs return for that name, not a guarantee of every private certificate or every certificate that expired before the first read.
What you add
Sign in with a one-time email link, create an organization, and name a domain you run. Owners and admins can add more domains and invite people. Viewers can read the inventory. Pro and Team can export a CSV and a printable report. Each organization's certificates are private to its members. The only inventory available without an account is the live demo, an example domain from public Certificate Transparency logs.
What gets stored
A scheduler runs every 5 minutes and only queues work. A queue consumer reads one page per message. CertLantern reads multiple independent Certificate Transparency sources. If the first source fails or is rate limited, it is skipped for a while and another source is used, including when certificates are already stored. CertLantern stores names, issuer, serial, not-before, not-after, key information, signature algorithm, source, and a fingerprint when the log includes the certificate. Daily caps can pause that work until the next UTC day. The dashboard then says Paused for budget.
You do not paste certificate files in. CertLantern does not need a server login, a DNS change, or a file on the host to build this inventory. The logs are already public.
A logged certificate may not be installed
The logs record that a certificate was issued. They do not record that you installed it, that you are still serving it, or that you meant to request it. Someone can obtain a certificate for a name you control, and that issuance can appear here. On Pro and Team, CertLantern can alert when that issuer is not one you have trusted for the domain, when a new name appears, or when a CAA record would stop the current issuer from renewing. Trusting an authority is one click from the alert. To see the certificate a host is actually serving, add an endpoint. That comparison is described on renewed but not deployed.
Expiry highlighting for these rows is covered under certificate expiry monitoring. To see one page for a domain without an account, use the certificate checker.