I have huge problems to understand how certificate transparency is different from mechanism like CRL or OCSP which allow to get the status of a certificate by contacting the CA directly.
- Which domains names are contacted when an application want to check the certificate of a specific server. What is sent to those domains name? (I just know it’s about logs)
- Since no request are send to CA in any part of the process, why can’t it work if the certificate issuer doesn’t support certificate transparency?
- Does it only protect against mis‑issued certificates, or can it fully replace OCSP because it protects every case of revoked certificates (for example, from attackers who has stolen private keys on a server)?
- Does the server, which the client tries to connect to, have to support certificate transparency? (like with OCSP stapling)