SSLBoard as a crt.sh alternative
If you’ve ever needed to find out which certificates exist for a domain, you’ve probably ended up on crt.sh. It has been the default Certificate Transparency search tool for years, it’s free, and it answers the question it was built to answer. What it can’t tell you is what your servers are doing with those certificates.
SSLBoard answers the second question. You type a domain and get a TLS posture report across every discovered host and endpoint. No account required.
What is crt.sh?
crt.sh is a free Certificate Transparency log search run by Sectigo. It ingests the public CT logs and lets you query them by domain, SAN, issuer, serial number, or SHA-256 fingerprint. Type %.example.com and you get every logged certificate for that domain and its subdomains, including pre-certificates, expired certificates, and certificates from CAs you never authorized.
It is more than a web form. Adding &output=json to a search returns structured JSON, which is what most scripts and subdomain enumeration tools use. There’s also an RSS feed per identity for new issuances, and Sectigo exposes the underlying certwatch database directly over PostgreSQL on port 5432, so you can run your own SQL against the full CT dataset. For certificate discovery work, that’s a lot of capability for free.
The limits are not about access to the data. They’re about what CT logs contain.
Where crt.sh stops
CT logs describe issuance, not deployment. A certificate appears in a log because a CA issued and logged it. Nothing in that record says whether it was ever installed, whether it’s serving traffic today, or whether the old certificate is still live on two of your five load balancer nodes. crt.sh will happily show you a certificate that has been sitting unused in a ticket queue since March.
No TLS handshake analysis. crt.sh never connects to your servers. It can’t tell you which protocol versions your endpoints negotiate, which cipher suites they accept, or whether forward secrecy holds. A domain with a clean crt.sh page can still be answering on TLS 1.0 with 3DES.
No key strength or post-quantum view. You can read the key type off an individual certificate, but there’s no rollup of RSA versus ECC across your estate, no view of key sizes, and nothing about whether your endpoints support hybrid key exchange like X25519Kyber768.
No DNSSEC or CAA analysis. crt.sh indexes certificates. It doesn’t check whether your zone is signed or whether you’ve published CAA records restricting which CAs can issue for you, which is the control that would have prevented some of the mis-issuances sitting in those logs.
Noise, and no way to rank it. A search for a mid-sized organization returns thousands of rows, most of them expired, many of them duplicate pre-certificate and leaf pairs. There’s no severity, no score, and no summary. Working out what actually matters is left to you.
Nothing to hand to anyone else. The output is a table in a browser tab or raw JSON. If you need to attach TLS evidence to an audit, or send a colleague something they can act on, you’re building that yourself.
How SSLBoard is different
SSLBoard uses CT logs as a starting point rather than an answer. You type a domain, and it discovers hostnames through Certificate Transparency and DNS enumeration, then performs live TLS handshakes against every resolved IP.
The report covers certificates (expiration timelines, issuer distribution, key types and sizes, SAN coverage, chain problems), protocol versions with the CVEs tied to anything outdated, cipher suites including 3DES, RC4, EXPORT, NULL and CBC-mode issues mapped to the hosts that accept them, forward secrecy, HTTP security such as redirect behaviour and HSTS headers, DNSSEC and CAA policy, connection errors like self-signed certificates and name mismatches, and post-quantum readiness.
Findings roll into a weighted score by category, each one ranked by severity and linked to the affected hosts. Reports are shareable by link and exportable as CSV, Markdown, and JSON, so the person who owns the fix gets a list rather than a screenshot.
The practical difference: crt.sh tells you a certificate for api.example.com was issued in June. SSLBoard tells you api.example.com is still serving the February certificate on one of its three IPs, and that the endpoint accepts TLS 1.0.
When to use crt.sh vs SSLBoard
crt.sh is the right tool for certificate discovery and forensics. Use it when you want to enumerate subdomains, look up a specific serial or fingerprint, check whether a CA logged something it shouldn’t have, or query the CT dataset directly with SQL. It’s free, it’s fast, and for that job nothing else is as direct.
SSLBoard is the better fit when the question is about configuration rather than issuance: before a compliance review, after a certificate rotation when you want to confirm the new certificate is actually live everywhere, when assessing a vendor or acquisition target’s domain, or any time someone asks how your TLS looks and you need an answer you can share.
If what you actually want is expiration reminders, SSLCalendar is a simpler fit. Enter a domain and an email address, then subscribe to an ICS feed in Google Calendar, Outlook, or Apple Calendar. It uses SSLBoard’s active-certificate checks, so it reminds you about certificates that are serving traffic rather than everything that ever appeared in a log.
Getting started
Go to sslboard.com, type your domain, and wait a few minutes. Your first scan is always free, with the full report including score, findings, and per-host breakdowns. No account required.
Photo by Javier Allegue Barros on Unsplash