1

If a CA, who is otherwise acting good and participating in the Certificate Transparency system, were to issue a certificate without reporting it to any log, would this be noticed somehow?

I'm thinking the answer to this is no, but I'm not certain.

The only way I see that it could work is if the issued certificates themselves somehow are linked via hashes or something, but as far as I can tell that's not case.

(The log entries are linked via the Merkel hash tree, but that just stops the Logs from being manipulated)

Improve this question
1
  • Also they could make many trees and only show one to different actors, if they can 1) tell actors appart 2) make sure actors don't exchange info
    – curiousguy
    Commented Oct 5, 2019 at 4:18

1 Answer 1

Reset to default
0

It would not be noticed if a certificate is just issued. It would be noticed though if the certificate gets used in practice since the validation against the CT log will fail (it is not in there). And it will notice if there is no CT information in the certificate even though it is required for the CA.

For more see How will Certificate Transparency be enforced?

Improve this answer
1
  • 1
    yes, once the certificate leaks to wild, it will be noticed, because fails CT validation. And CAs are risking with their reputation if they issue such certificates in the wild.
    – Crypt32
    Commented Jul 4, 2019 at 11:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .