The raw data is publicly available on Certificate Transparency log servers[1]. There are various clients for CT log servers out there, but they all require you to essentially download the entire log to query it (there's no query API).

[1]: https://www.certificate-transparency.org/known-logs

FWIW, keeping internal hostnames private might be part of a security-by-obscurity strategy.

They are following that Certificate transparency standard that, eventually, everyone will need to follow.

It's already a requirement for anyone issuing EV certificates.

Note crt.sh is actually a Comodo website, for interrogating the CT logs.

One way of putting it is that we want to get caught as quickly as possible if we ever misissue a certificate. We don't think it's a benefit to us or the certificate-using (relying party) public if we have the ability to secretly issue certs that are erroneous.