Search Certificates

Exact domain/subdomain match via domain_certs lookup

When true, match domain as a wildcard pattern: cert must have a SAN entry matching '*.{domain}' or '%{domain}'. Requires domain to also be set.

Alias for subject_cn — Subject CN ILIKE match

Subject CN ILIKE match (use 'cn' or 'subject_cn', both accepted)

Alias for issuer_cn — Issuer CN ILIKE match

Issuer CN ILIKE match

Issuer organisation ILIKE match

SAN array contains exact element match

SAN substring match (task #612). Matches certificates with ANY name (SAN or CN-derived) containing this substring. Without a 'domain' scope this is a GLOBAL sweep: it must be at least the trigram minimum length and is governed by the global_sweep_per_hr rate class.

Comma-separated attribution classes to keep after classifying each row: first_party, lookalike_candidate, third_party_integration, substring_collision, shared_hosting. Requires a brand token (cn or san_contains). Unknown values are rejected (422), never ignored. The SQL total remains unfiltered, so total_is_lower_bound is true when this is set. Prefer POST /v1/sweeps for a complete classified inventory.

Comma-separated domains the caller asserts are the brand's own. Used only with match_class_filter; each name is reduced to its registrable domain and treated as an authoritative first_party allowlist.

not_after >= this ISO-8601 datetime — only certs valid after this point

not_after <= this ISO-8601 datetime — only certs that expire on or before

not_after <= this ISO-8601 datetime (expires on or before)

not_after >= this ISO-8601 datetime (expires on or after)

true → only expired certs (not_after < NOW()), false → only valid

Only certs whose not_after falls within the next N days (NOW() <= not_after <= NOW() + N days). Drives the 47-day expiry-cliff view.

first_seen >= this ISO-8601 datetime. first_seen is the CertIndex database write/ingest timestamp, not the CT-log append timestamp; it is not a substitute for logged_at.

first_seen <= this ISO-8601 datetime. first_seen is the CertIndex database write/ingest timestamp, not the CT-log append timestamp; it is not a substitute for logged_at.

logged_at >= this ISO-8601 datetime — only certs whose CT log timestamp is on or after this instant. logged_at is the TimestampedEntry.timestamp from the MerkleTreeLeaf (RFC 6962 §3.4): when the log committed the certificate, not when CertIndex ingested it. Null on historical rows and crt.sh-sourced rows; see the logged_at_coverage disclosure block.

logged_at <= this ISO-8601 datetime — only certs whose CT log timestamp is on or before this instant. See logged_at_after for semantics.

Exact public-key type match (RSA / ECDSA / Ed25519 / Ed448 / DSA)

Signature algorithm ILIKE match (e.g. sha256WithRSAEncryption)

true → only weak-crypto certs (undersized key or SHA-1/MD5 sig)

Only certs whose key_size >= this many bits

When true, collapse precert/leaf duplicate pairs by dropping precert rows whose leaf counterpart is also indexed (GH #203). Requires a 'domain' or 'san' scope — the live counterpart match is bounded by that predicate.

DEPRECATED offset pagination (GH #243). Cursor pagination (cursor=) is the primary mode; offset mode remains for one release and is answered with a Deprecation warning header. Ignored when cursor is supplied.

Opaque keyset cursor (GH #243 / GH #263) — the PRIMARY pagination mode for this route. Pass cursor='*' (the coalescing-proof start token) to start a cursor enumeration, then the next_cursor from each response until it is null (cursor-mode pages ALWAYS carry the next_cursor key; an explicit null marks the terminal page). Cursor pages are ordered newest-first (first_seen DESC with a monotone internal-id tie-break) and are stable against concurrent inserts. The cursor is scoped to the exact filter combination it was minted for; replaying it with different filters fails 400 invalid_cursor. In cursor mode limit may go up to the caller's tier ceiling (base 200 free, 1000 paid); page is ignored. Global (domain-less) sweeps keep the same total depth cap as offset mode. Omit cursor entirely for the deprecated offset pagination. Legacy: cursor= (empty string) also starts enumeration but may be coalesced to null by some transports.