High-performance Certificate Transparency (CT) monitoring tool written in Rust. Real-time stream of newly issued SSL/TLS certificates from CT logs. Rust implementation of certstream-server with improved performance and memory efficiency.
A Certstream server written in Rust. It monitors Certificate Transparency (CT) logs and streams newly issued SSL/TLS certificates over WebSocket and Server-Sent Events (SSE).
Certstream aggregates certificates from Certificate Transparency logs and streams them in real time. This implementation is compatible with existing Certstream clients and supports both RFC 6962 and static-CT logs.
Key features:
Full API documentation, client examples, configuration reference, and self-hosting notes are at certstream.dev.
Want the stream without running a server? There is a free hosted CertStream API at wss://api.certstream.dev/.
Prebuilt Linux binaries are static musl builds. Release archives include SHA-256 checksums.
# Linux and macOS, x86_64 and arm64; verifies the checksum before installing
curl -fsSL https://raw.githubusercontent.com/reloading01/certstream-server-rust/main/install.sh | sh
# Homebrew
brew install reloading01/tap/certstream-server-rust
# Cargo
cargo install certstream-server-rust
# Docker
docker run -d -p 8080:8080 ghcr.io/reloading01/certstream-server-rust:latest
Signed apt and rpm repositories, Docker Compose, and installer options are covered in the self-hosting docs.
No configuration is required. The server discovers CT logs automatically, serves WebSocket on port 8080, and persists its position so restarts resume instead of replaying log history.
All settings are optional. Environment variables override YAML values, and YAML values override built-in defaults. Every variable and YAML key is listed in the configuration reference.
| Variable | Default | Description |
|---|---|---|
CERTSTREAM_PORT | 8080 | HTTP/WebSocket port |
CERTSTREAM_SSE_ENABLED | false | Enable SSE |
CERTSTREAM_API_ENABLED | false | Enable the REST API |
CERTSTREAM_AUTH_ENABLED | false | Require bearer tokens (CERTSTREAM_AUTH_TOKENS) |
CERTSTREAM_CONNECTION_LIMIT_ENABLED | false | Enable global and per-IP connection limits |
CERTSTREAM_CT_LOG_STATE_FILE | certstream_state.json | CT log position file |
| Endpoint | Stream |
|---|---|
ws://host:8080/ | Lite |
ws://host:8080/full-stream | Full data with DER and chain |
ws://host:8080/domains-only | Domain names only |
http://host:8080/sse | SSE, when enabled (?stream=full or ?stream=domains) |
/health, /health/deep, /metrics | Health checks and Prometheus metrics |
/api/stats, /api/logs, /api/cert/{hash} | REST API, when enabled |
Streaming endpoints accept domain and issuer query parameters for server-side filtering. See the documentation for message formats, version 2 output, and range export.
See RELEASE_NOTES.md for version history.
Bug reports, CT log quirks, and pull requests are welcome. See CONTRIBUTING.md for how to build, test, and send a change.
Starring the repository or sharing it helps the project get found. You can also sponsor it on GitHub.
MIT. See LICENSE.