Certificate Query Examples

There are several tables of example queries in this doc.

The first table below provides working queries you can use to learn the Censys Search Language for querying certificate records.

The first column indicates the Censys Search Language feature showcased in the query, the second column provides a description of the query, and the third column presents the query syntax, which is linked to the results page on search.censys.io.

Examples of Search Language Features

Search Feature	Query Description	Query
Full Text Search	Search for cert records with any mention of the word apple anywhere	`apple`
Full Text Search	Search for cert records whose data contains the words apple and inc although not necessarily together	`apple inc`
Full Text Search	Search for cert records whose data contains the phrase apple inc	`"apple inc"`
Field:Value Pairs	Search for cert records whose name fields contain censys.io or any subdomain of that name.	`names: censys.io`
Exact Match Operator (`=`)	Search for cert records whose name fields contains the exact name censys.io	`names=censys.io`
Boolean Logic	Search for cert records of unexpired but revoked certificates that were used for key agreement but not signing certificates	`parsed.extensions.key_usage.key_agreement: true and parsed.extensions.key_usage.certificate_sign: false and labels=revoked and labels=unexpired`
Set Operator	Search for cert records that have any of the following validity lengths	parsed.validity_period.length_seconds: {`7.775999e+06, `7.862399e+06`, `3.1622399e+07`, `259199`}
Boolean Logic	Search for cert records whose certs were never trusted by NSS	`not validation.nss.had_trusted_path: true`
Wildcards	Search for cert records with domain-style names that are close to "censys"	`names=cens?s.*`
Regular Expressions (Paid users only)	Search for cert records with domain-style names that are close to censys that use a certain TLD	`names=/cens.*s\.(net\|info\|biz)/`
Ranges	Search for cert records whose validity period ends between January 1 and January 30, 2024	`parsed.validity_period.not_after: [2024-01-01 to 2024-01-31]`
Nested field queries	Search for cert records entered into the Google Xenon 2024 CT log on October 30, 2023	ct.entries: (key=`google_xenon_2024` and value.added_to_ct_at=`2023-10-30`)

Examples of Certificate Attributes

The table below provides working queries you can use to learn the data model of certificate records.

The first column indicates the type of information in the certificate record showcased in the query, the second column provides a description of the query, and the third column presents the query syntax, which is linked to the results page on search.censys.io.

Cert Record Attribute Query Description Query

All Names

Search for the name censys.io in any of the names fields present in a cert record

names=censys.io

All Names

Search for the name about.censys.io in subject alternative name (SAN) field

parsed.extensions.subject_alt_name.dns_names=about.censys.io

Subject DN

Search for cert records whose the subject DN includes an organization specified as "IBM"

parsed.subject.organization:”IBM”

Issuer DN

Search for cert records of certs issued by GTS X3