Why crt.sh Times Out (and the 7 Sources That Do Not)
If you have used crt.sh for subdomain recon for more than a week, you have hit a 502, a timeout, or a query that just hangs. It is not you. It is the single most relied-upon Certificate Transparency search tool on the internet, run for free, with no SLA. Here is why it struggles, and what actually keeps working when it does not.
What crt.sh actually is
crt.sh is a free, public search engine over Certificate Transparency logs, the append-only, publicly auditable records every Certificate Authority is required to publish when it issues a TLS certificate. Since a certificate lists every hostname it covers, searching those logs for %.example.com reveals every subdomain that has ever had a certificate issued for it, including ones nobody meant to expose.
It is maintained largely as a community service, backed by a single PostgreSQL database that has grown to index billions of certificate log entries. There is no company behind it charging for reliability, no paid tier, and no status page.
Why it fails under load
Three things compound against it:
- It is the default choice. Nearly every subdomain enumeration tool, script, and tutorial points to crt.sh first, concentrating a huge share of global recon traffic onto one free service.
- Certificate Transparency logs keep growing. Every certificate issued anywhere, by any CA, for any domain, gets indexed. The dataset only grows, and query complexity grows with it.
- There is no rate limiting communicated to callers. Instead of a clean 429 with a retry-after header, heavy load usually just shows up as a 502 Bad Gateway or a request that never returns, which is worse for anything trying to handle it gracefully.
This is not a crt.sh criticism
A free, ad-free, community-run index of the entire web's certificate history staying up at all under this load is genuinely impressive. The lesson is not "avoid crt.sh", it is "do not depend on any single source for something you actually need to work."
The fix is not a replacement, it is redundancy
The instinct is to look for "a crt.sh alternative", a single tool to swap in. That is the wrong frame. No single source, including crt.sh at its best, has full coverage on its own, since different sources catch different subdomains: some appear only in historical DNS snapshots, some only via active brute-force, some only in a specific CA's logs that a different aggregator indexed faster.
The actual fix is querying multiple independent sources in parallel and merging the results, so that when one is slow, overloaded, or briefly down, the scan still completes using what the others returned.
This is exactly how Subdomain Finder works
Subdomain Finder queries crt.sh, CertSpotter, HackerTarget, Wayback Machine, AlienVault OTX, and RapidDNS in parallel, plus an active DNS brute-force, then merges and de-duplicates. If crt.sh times out mid-scan, you still get a complete result from the other six.
Try a scan free →Seven sources, compared
| Source | Type | Strength |
|---|---|---|
| crt.sh | Certificate Transparency | Deepest CT log coverage, when it responds |
| CertSpotter | Certificate Transparency | Independent CT index, often faster under load |
| HackerTarget | Passive DNS | Fast, simple, free-tier rate limited |
| Wayback Machine | Historical crawl data | Finds subdomains that existed but are no longer certified |
| AlienVault OTX | Passive DNS / threat intel | Catches subdomains seen in threat intelligence feeds |
| RapidDNS | Passive DNS | Another independent aggregation, different blind spots |
| Active brute-force | Live DNS resolution | Finds subdomains no passive source ever recorded |
No single row in that table is sufficient on its own. Together, they cover each other's gaps.
Frequently asked questions
Is crt.sh down right now?
crt.sh does not publish a status page, so the most reliable way to check is to try a query directly. It commonly returns 502 or times out under load rather than being fully offline for extended periods.
What is the best crt.sh alternative?
There is no single alternative that fully replaces it, since crt.sh indexes the most Certificate Transparency logs of any free tool. The more reliable approach is combining it with CertSpotter, passive DNS sources, and active brute-force, so one source's outage does not stop your scan.
Why is crt.sh so slow?
It is a free, community-run service querying a large PostgreSQL database of Certificate Transparency log entries, with no SLA and no dedicated scaling budget. High query volume from security tools worldwide regularly saturates it.