Every TLS certificate, the second it's issued.
Treehead tails all Chrome- and Apple-trusted Certificate Transparency logs, verifies every Merkle root against the signed tree head, and gives you instant search and a real-time WebSocket firehose.
The firehose
One WebSocket. Every new certificate on the internet.
This is the real feed, streaming into your browser right now. Filter by domain, substring or issuer, resume from a sequence number after a disconnect, and drop duplicate copies of the same certificate.
Built differently
What crt.sh should have been.
Cryptographically verified
Every checkpoint and STH signature is checked and every Merkle root recomputed from the leaves. If a log forks or lies, Treehead records the incident.
Real-time WebSocket
About a second from log append to your socket. Batched native protocol plus CertStream-compatible endpoints, so existing tools just swap the URL.
Fast search that pages
Bloom-filtered, sharded index on R2. Huge domains return the first page in milliseconds instead of timing out.
Tiled + RFC 6962 logs
Native support for static-CT tiled logs (Let's Encrypt, Google, Geomys, IPng) and classic RFC 6962 logs alike.
Inclusion proofs
Every certificate page shows its leaf hash and audit path, so you can check it's really in the log instead of trusting us.
Runs on the edge
Durable Objects per log, hibernating WebSocket relays and R2 storage on Cloudflare's network. No single overloaded Postgres.
Treehead vs crt.sh
| crt.sh | Treehead | |
|---|---|---|
| Real-time stream | None | WebSocket, filters, resume cursor |
| Large-domain search | Times out / 502 | Paged, newest first |
| Log verification | Trust the database | Signed heads + recomputed Merkle roots |
| Static (tiled) CT logs | Partial | First-class |
| Per-log lag & health | Hidden | Public status page |
| Precert / cert duplicates | Shown separately | Merged into one record |