crt.guru is a product by Crt.guru in the External Attack Surface Management category. It covers TLS, SSL and PCI DSS.

What is the pricing for crt.guru?

crt.guru is a commercial product. For pricing, visit https://crt.guru/ or contact Crt.guru.

What are alternatives to crt.guru?

Alternatives to crt.guru listed on CybersecTools: 1. ctlogs.dev - Fast Certificate Transparency search and JSON API for subdomain reconnaissance. (Commercial) 2. Attack Surface Scan - Agentless external attack surface monitoring with continuous change detection. (Commercial) 3. Assetnote Exposure Engine - Continuous exposure detection & verification engine for attack surface mgmt. (Commercial) 4. SurfaceDiff - Continuous external attack surface monitoring that shows what changed between scans. (Commercial) 5. v6Protect Trusted Third Party Security Service - Independent security scoring and attestation for third-party managed web apps (Commercial) Compare all crt.guru alternatives at https://cybersectools.com/alternatives/crtguru

What deployment and organization size does crt.guru fit?

crt.guru is available as a cloud service. It is listed for startups, small businesses, mid-market companies and enterprises. Pricing is commercial. Ask Crt.guru for pricing and support terms.

crt.guru: External Attack Surface Management (2026)

Name: crt.guru
Author: Crt.guru

What is crt.guru?

crt.guru is an external TLS certificate monitoring service that scans domains and hostnames from multiple geographic regions without requiring agents, server access, or code changes.

The service supports monitoring across multiple protocols beyond standard HTTPS, including LDAPS, SMTP STARTTLS, and IMAPS on any port. Scans are performed from locations including Frankfurt, New York, and Amsterdam, enabling detection of issues that local or single-region checks may miss, such as CDN edge nodes serving stale certificates.

Core monitoring capabilities include:

Expiry alerts sent at 30, 14, 7, and 1 day before certificate expiration
Vulnerability scanning for known TLS weaknesses including Heartbleed, ROBOT, and CCS Injection
Weak cipher detection
Certificate revocation detection
Certificate Transparency (CT) log monitoring to detect unauthorized certificate issuance for monitored domains
Compliance checks against Mozilla, PCI DSS 4.0, and NIST standards
One-click PDF compliance report generation in formats suited for CISOs, DevOps, and developers
Portfolio-level risk scoring, compliance matrix, expiry calendar, and trend tracking

Notifications are delivered via email, Telegram, Discord, and Slack.

Plans range from a free tier (3 assets, daily scans, single region, 7-day history) to Enterprise (200 assets, 30-minute scan intervals, unlimited regions and history, 50 team members). Paid plans include on-demand manual scans, scan comparison and diff, and extended history retention. A REST API is also available.

Security Compliance Training

Security Reporting

Vulnerability

REST API