I was curious about how to supply certificate transparency from my web server. There are 3 ways certificate transparency information can be delivered to the client's browser (Source: http://www.certificate-transparency.org/how-ct-works):
- X.509v3 Extension (Embedded in the certificate)
- OCSP Stapling (Signed, timestamped cached OCSP response, serving the SCT in OCSP extension)
- TLS Extension (Doesn't require any action on part of the CA, server operator can submit standard certificate to CT log, and receive a SCT, and then deliver this SCT to client via TLS extension)
Here are screenshots of each example: https://i.sstatic.net/nrb1w.png
I am seeking resources, implementations of delivering SCT via TLS extension.
signed_certificate_timestamp
extension if you pass in the timestamp inside an*.SCT
file. See: ritter.vg/blog-require_certificate_transparency.html (Archived here.)