I was curious about how to supply certificate transparency from my web server. There are 3 ways certificate transparency information can be delivered to the client's browser (Source: http://www.certificate-transparency.org/how-ct-works):
- X.509v3 Extension (Embedded in the certificate)
- OCSP Stapling (Signed, timestamped cached OCSP response, serving the SCT in OCSP extension)
- TLS Extension (Doesn't require any action on part of the CA, server operator can submit standard certificate to CT log, and receive a SCT, and then deliver this SCT to client via TLS extension)
Here are screenshots of each example: https://i.imgur.com/WDccXfp.png
I am seeking resources, implementations of delivering SCT via TLS extension.