01 · Product name
crt.sh
Sectigo certificate search. No price was printed.
Published by Sectigo Limited.
In short
crt.sh is the certificate search Sectigo Limited publishes at crt.sh. On 22 Oct 2026 the homepage asked for an identity, a SHA-1 or SHA-256 fingerprint, or a crt.sh ID, and the footer read © Sectigo Limited 2015-2026. An identity search for owasp.org returned crt.sh ID 29683565917, not before 2026-10-03, not after 2027-01-01, common name name-virt-host.owasp.org, issuer Let's Encrypt YR1. No price and no SPDX field were printed. Domain and infrastructure is the nearest category. A logged certificate is not proof of who runs the name today.
Product pricing strategy
02
Free
crt.sh printed no dollar price on 22 Oct 2026. The homepage has no checkout, no plan names, and no SPDX field. The footer is © Sectigo Limited 2015-2026. All rights reserved. That sentence is the rights line. It is not an SPDX identifier, and this listing does not fill one in. A certificate row is a search result, not a fee. Let's Encrypt is the issuer name on the rows above. It is not a crt.sh price. If a later page sells a bulk feed, quote that page on its own. This review did not open one.
Utility and features
03
The homepage at https://crt.sh/ is a search box. The label says to enter an identity such as a domain or an organization, a certificate fingerprint, or a crt.sh ID, and it offers an Advanced link. The copyright line is © Sectigo Limited 2015-2026. All rights reserved. This listing did not find a GitHub repository for the service, and the homepage did not print an SPDX identifier. All rights reserved is the footer. It is not a license name this listing invents.
- Footer is Sectigo, 2015-2026. The homepage copyright line is © Sectigo Limited 2015-2026. No SPDX field was printed.
- owasp.org row 29683565917. Not before 2026-10-03, not after 2027-01-01, common name name-virt-host.owasp.org, issuer Let's Encrypt YR1.
- docs.owasp.org row 29527933696. Not before 2026-09-17, not after 2026-12-16, common name docs.owasp.org, issuer Let's Encrypt YE1.
An identity search for owasp.org, match ILIKE, opened a certificate table. The first row was crt.sh ID 29683565917, not before 2026-10-03, not after 2027-01-01, common name name-virt-host.owasp.org, issuer C=US, O=Let's Encrypt, CN=YR1. The next row, 29617945654, used the same common name and the same issuer name. A second search, docs.owasp.org, put ID 29527933696 first: not before 2026-09-17, not after 2026-12-16, common name docs.owasp.org, issuer Let's Encrypt YE1. ID 29528042549 on that page used issuer YR2 for the same common name. A request for the single-certificate URL of 29617945654 timed out in this review and is not described as opened.
- 1
Cite the crt.sh ID with the query that returned it. Do not paste the owasp.org dates onto docs.owasp.org.
- 2
Leave the license field empty. Quote the footer when you mean the rights line.
- 3
Treat a row as a logged certificate. It does not identify the current operator of the name.
Caveats
04
Two searches are two tables. ID 29683565917 belongs to the owasp.org search and the name name-virt-host.owasp.org. ID 29527933696 belongs to the docs.owasp.org search. Do not move a not-before date from one row onto the other, and do not treat YR1 and YE1 as the same issuer string.
The homepage did not print a license field. All rights reserved stays the footer. A certificate transparency row shows what a log accepted. It does not show who controls the hostname on the day you read it, and it does not show a person's location. Domain and infrastructure is the nearest category because the query is a name or a fingerprint. crt.sh is not a port scan. A timed-out certificate page is not a page this listing opened.
Screenshots
05
Potential use cases
06
- A note is about to treat one crt.sh row as the certificate for owasp.org. On 22 Oct 2026 an identity search for owasp.org put crt.sh ID 29683565917 first, not before 2026-10-03, not after 2027-01-01, common name name-virt-host.owasp.org, issuer Let's Encrypt YR1. The docs.owasp.org search put ID 29527933696 first, issuer Let's Encrypt YE1. Keep the query with the ID.
- The footer is about to be rewritten as a license. The homepage says © Sectigo Limited 2015-2026. All rights reserved. No SPDX field was printed, and no dollar price was printed. Quote the footer. Leave the license field empty. A later bulk-feed page, if one exists, was not opened.
- A logged certificate is about to be briefed as current control of a hostname. crt.sh shows a certificate a log accepted. It does not show who operates the name on the day you read the row, and it does not show a person's location. Domain and infrastructure is the nearest category. The page is a certificate search.
Hard cases
The case where the first result is easy to over-read.
One ID is used for two names
ID 29683565917 belongs to the owasp.org search and the name name-virt-host.owasp.org. ID 29527933696 belongs to docs.owasp.org. Moving the not-before date from one row onto the other invents a certificate. Cite the ID, the query, and the issuer string together.
Questions
Is crt.sh free?
The homepage printed no price on 22 Oct 2026. There is no SPDX field. The footer is © Sectigo Limited 2015-2026. All rights reserved.
Which certificate did the owasp.org search show first?
crt.sh ID 29683565917, not before 2026-10-03, not after 2027-01-01, common name name-virt-host.owasp.org, issuer Let's Encrypt YR1. The docs.owasp.org search is a different table.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
crt.sh certificate search
https://crt.sh/Documentation
crt.sh identity search for owasp.org
https://crt.sh/?q=owasp.orgDocumentation
crt.sh identity search for docs.owasp.org
https://crt.sh/?q=docs.owasp.org