SSL/TLS Certificate API
Monitor SSL/TLS certificates as they are issued across all TLDs. 6 to 10 million certificates processed daily, with 90 days of searchable history. Certificate activity provides broad visibility across both gTLD and ccTLD domains.
What the feed contains
SSL/TLS certificates are logged publicly via Certificate Transparency logs maintained by browser vendors and CAs. CodePunch ingests this stream continuously, processing 6 to 10 million newly issued certificates per day and making them searchable via API.
Because certificate issuance is not limited by TLD type, this feed provides visibility into both gTLD and ccTLD domain activity. When a domain provisions an SSL/TLS certificate, it can appear in this feed, making certificate activity a valuable complement to the Domain Activity and DNS feeds.
The 90-day searchable history allows retrospective investigation into certificate issuance patterns, useful for incident response and historical threat analysis.
API endpoint
Features
Daily Certificate Stream
6 to 10 million SSL/TLS certificates processed daily from Certificate Transparency logs. Covers certificate activity across all TLDs.
90-Day Searchable History
Search and filter certificates issued during the past 90 days. Supports retrospective investigation, pattern analysis, and historical threat research.
ccTLD Domain Visibility
SSL/TLS certificate issuance provides an additional public signal for tracking domain activity across country-code TLDs, including cases where other DNS activity datasets have limited visibility.
Subject and SAN Data
Each certificate record includes subject common name, Subject Alternative Names, issuing CA, validity dates, and serial number for full certificate profiling.
Trademark and Malware Analysis
Filter the certificate stream by keyword against subject and SAN fields for trademark monitoring and malware infrastructure detection across all TLDs.
Bulk Ingestion Support
Paginated responses designed for high-volume data ingestion pipelines. Pull the full daily certificate batch into your own data store for local querying and enrichment.
Coverage
| TLD Type | Coverage | Source |
|---|---|---|
| gTLDs (.com, .net, .org and all others) | Broad | Certificate Transparency logs |
| ccTLDs (.uk, .de, .au and others) | Broad | Certificate Transparency logs |
| History depth | 90 days | Searchable via API |
Coverage depends on certificate issuance. Domains that do not provision an SSL/TLS certificate will not appear in this feed regardless of TLD.