Certstream API Documentation

const ws = new WebSocket('wss://ws.certstream.dev/');

ws.onmessage = (event) => {
    const data = JSON.parse(event.data);
    if (data.message_type === 'certificate_update') {
        console.log(data.data.leaf_cert.all_domains);
    }
};

# Lite stream
curl -N https://ws.certstream.dev/sse

# Full stream
curl -N "https://ws.certstream.dev/sse?stream=full"

# Domains only
curl -N "https://ws.certstream.dev/sse?stream=domains"

# pip install certstream
import certstream

def callback(message, context):
    if message['message_type'] == 'certificate_update':
        domains = message['data']['leaf_cert']['all_domains']
        print(domains)

certstream.listen_for_events(callback, url='ws://localhost:8080/')

import "github.com/CaliDog/certstream-go"

stream, _ := certstream.CertStreamEventStream(false)
for event := range stream {
    fmt.Println(event.Data.LeafCert.AllDomains)
}

const WebSocket = require('ws');
const ws = new WebSocket('ws://localhost:8080/');

ws.on('message', (data) => {
    const msg = JSON.parse(data);
    if (msg.message_type === 'certificate_update') {
        console.log(msg.data.leaf_cert.all_domains);
    }
});

# WebSocket with token
wscat -c ws://localhost:8080/ -H "Authorization: Bearer your-token"

# SSE with token
curl -H "Authorization: Bearer your-token" http://localhost:8080/sse

# Quick start
docker run -d -p 8080:8080 -p 8081:8081 reloading01/certstream-server-rust:latest

# With custom config
docker run -d \
  -p 8080:8080 \
  -p 8081:8081 \
  -v ./config.yaml:/app/config.yaml \
  -v ./state:/app/state \
  reloading01/certstream-server-rust:latest

# Docker Compose
version: '3.8'
services:
  certstream:
    image: reloading01/certstream-server-rust:latest
    ports:
      - "8080:8080"
      - "8081:8081"
    volumes:
      - ./config.yaml:/app/config.yaml
      - ./state:/app/state
    restart: unless-stopped

# Docker build
docker build -t certstream-server-rust .
docker run -d -p 8080:8080 certstream-server-rust

# Cargo build
cargo build --release
./target/release/certstream-server-rust

# Docker Compose
docker compose up -d

host: "0.0.0.0"
port: 8080
log_level: "info"
buffer_size: 1000
ct_logs_url: "https://www.gstatic.com/ct/log_list/v3/all_logs_list.json"

protocols:
  websocket: true
  sse: true
  metrics: true
  health: true
  example_json: true

ct_log:
  state_file: "/data/state.json"
  batch_size: 256
  poll_interval_ms: 500
  retry_max_attempts: 3
  request_timeout_secs: 30

connection_limit:
  enabled: true
  max_connections: 10000
  per_ip_limit: 100

auth:
  enabled: false
  tokens:
    - "secret-token-1"
    - "secret-token-2"
  header_name: "Authorization"

hot_reload:
  enabled: true

custom_logs:
  - name: "My Custom CT Log"
    url: "https://ct.example.com/log"

# Static CT logs (Sunlight / static-ct-api protocol)
# Use monitoring prefix (mon.*) for read access
static_logs:
  - name: "Let's Encrypt 'Willow' 2025h2d"
    url: "https://mon.willow.ct.letsencrypt.org/2025h2d/"
  - name: "Let's Encrypt 'Willow' 2026h1"
    url: "https://mon.willow.ct.letsencrypt.org/2026h1/"
  - name: "Let's Encrypt 'Sycamore' 2025h2d"
    url: "https://mon.sycamore.ct.letsencrypt.org/2025h2d/"
  - name: "Let's Encrypt 'Sycamore' 2026h1"
    url: "https://mon.sycamore.ct.letsencrypt.org/2026h1/"