The Postgres query inherited the verbatim form crt.sh's web UI uses to
render its certificate browser. subfinder consumes NAME_VALUE only, so
GROUP BY sub.CERTIFICATE on multi-KB DER blobs, the four x509_*
function calls per group, the correlated LEFT JOIN LATERAL into
ct_log_entry, and the trailing ORDER BY ENTRY_TIMESTAMP are all
discarded.
Replacing the WITH/JOIN with a direct DISTINCT NAME_VALUE preserves the
result set (verified parity on iana.org: 24 unique names from both
queries) and lets the LIMIT 10000 clause bound unique subdomains
instead of raw certificate rows. The downstream SplitSeq + Extractor
path is unchanged.
Co-authored-by: Chris (ChrisJr404) <11917633+ChrisJr404@users.noreply.github.com>
