I was curious about how to supply certificate transparency from my web server. There are 3 ways certificate transparency information can be delivered to the client's browser (Source: http://www.certificate-transparency.org/how-ct-works):

  1. X.509v3 Extension (Embedded in the certificate)
  2. OCSP Stapling (Signed, timestamped cached OCSP response, serving the SCT in OCSP extension)
  3. TLS Extension (Doesn't require any action on part of the CA, server operator can submit standard certificate to CT log, and receive a SCT, and then deliver this SCT to client via TLS extension)

Here are screenshots of each example: https://i.imgur.com/WDccXfp.png

I am seeking resources, implementations of delivering SCT via TLS extension.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.