Questions tagged [certificate-transparency]
a system where Certificate Authorities are required to log all certs they issue to one or more Certificate Transparency Logs, which are publicly accessible. The purpose is to add additional accountability for CAs, and allow easy searching of all certificates issued to a domain.
43
questions
2
votes
1
answer
242
views
Certificate/key revocation
Systems like Certificate Transparency and Key transparency store trees of keys/certificates. How would a user be able to remove a fraudulent/expired key or certificate? Do the trees stay the same and ...
- 33
0
votes
1
answer
103
views
How can I programmatically fetch the CT log? [duplicate]
How can I programmatically fetch the Certificate Transparency log?
One of the components of our infrastructure that watches certificate issuances is basically falling over; I had believed that it ...
- 1,086
0
votes
1
answer
606
views
crt.sh shows certificates for domains I don't recognize
Today I learned of the existence of crt.sh. I typed one of my domain names into the search box to find out what it returns. I found a lot of certificate entries for domains that I don't recognize, and ...
- 111
0
votes
2
answers
255
views
What prevents certificate authorities from issuing fraudulent TLS certificates?
There have been reports of attacks against certificate authorities resulting in the issuance of fraudulent TLS certificates for sites such as google.com, yahoo.com, and skype.com. These attacks seem ...
- 31
0
votes
0
answers
40
views
How does Certificate Transparency protect from hacked CA server [duplicate]
I was able to grasp how CT works by reading this explanation, but one thing remains unclear for me - how CT may protect ecosystem from hacked CA server. For example, someone hacked Digicert, and now ...
- 423
2
votes
1
answer
1k
views
How to create and embed Signed Certificate Timestamp (SCT) in certificate
I have deployed a Certificate Transparency (CT) log server that uses Google's CTFE (named "certificate-transparency-go" on Github) and Trillian Projects. And I have issued a pre-certificate, ...
- 33
1
vote
1
answer
160
views
Comparing ACME client logs against Certificate Transparency logs
Inspired by this comment from Can DDNS provider perform a MITM attack?, I was wondering if there is an automated way to check the Certificate Transparency logs for malicious/unexpected certificates.
...
- 601
0
votes
1
answer
90
views
Does the wildcard certificates registered late?
I've been trying to understand the process how the certificates are being registered and wildcard certificates got my attention.
For some companies that offer free hosting in their site, I noticed ...
3
votes
0
answers
140
views
What is expected of domain owners in the Certificate Transparency system?
As I understand it, Certificate Transparancy provides proof to the client that the presented certificate is publicly accessible in CT logs. The certificate being in the logs enables a domain owner to ...
- 53
2
votes
1
answer
3k
views
How does the certificate transparency check in Chrome work?
I've been reading up on Certificate Transparency (CT), but can't find anywhere how a client (like a browser) is supposed to check if the certificate is present in any of the certificate transparency ...
- 53
4
votes
2
answers
1k
views
Understanding Certificate Transparency in Mobile apps and How it Affects Traffic Proxying
I am familiar with the basics of CT and certificate pinning. However, I'm failing to understand how CT properly replaces pinning in mobile apps in a scenario in which, for example, an attacker steals ...
- 43
2
votes
0
answers
245
views
What are the risks of trusting a certificate that is not logged in CT logs?
A website that I do banking on has a login page on a different subdomain than their main website, and this login page is secured with an Amazon-issued domain-validation certificate (their main website ...
- 175
23
votes
2
answers
4k
views
Are we gossiping in Certificate Transparency?
Ben Laurie's original paper on Certificate Transparency proposed that clients (browsers) should "gossip". In particular, it proposed that when a browser connects to a web server, it should ...
- 100k
0
votes
1
answer
141
views
CT logs for non browser applications
Most what I read on CT logs is about browsers checking the logs for websites.
But what about normal applications or updates for operating systems (like apt-get over https, windows/osx updates ...)
Is ...
- 19
4
votes
2
answers
986
views
How do you get a CA trusted by Certificate Transparency logs?
How would one go about getting in contact with a popular CT logs operator's, let's say Google Pilot, and how would one get a CA root included in their log? Are there open CT logs that allow untrusted ...
- 55
0
votes
1
answer
356
views
Submit a pre certificate to Certificate Transparency logs via APIs?
How would a CA submit a certificate to Certificate Transparency logs? Preferably Google's Pilot or Rocketeer CT.
Would one submit via an API, SDK, library? If submitting should it be a render of a ...
- 55
2
votes
0
answers
193
views
OCSP responder that returns embedded SCTs
There are three ways for a TLS client to obtain Signed Certficiate Timestamps (SCTs):
During the TLS handshake itself using the SCT List extension
As embedded precertificate SCTs in the leaf ...
- 405
7
votes
2
answers
5k
views
Certificate Transparency logs: why are so many operated by same entities and how do they differ?
I'm trying to understand the point of having multiple Certificate Transparency logs. While I understand that it solves the problems of reliability of trust, what baffles me is that so many are ...
- 6,584
1
vote
2
answers
397
views
Why infamous Addtrust certificate is still not expired (same private key) for code signing?
As many of you know Addtrust certificate https://crt.sh/?id=1 expired 30 May 2020 as well as many other intermediate certs and now we have to update certs on many servers to either root cert https://...
4
votes
1
answer
3k
views
Adding Expect-CT header to HTTP response
In the security test report, I have a recommendation to add Expect-CT header to the HTTP response from web application, additionally developers set this to:
Expect-CT: max-age=0, report-uri=
I am ...
- 1,363
7
votes
2
answers
3k
views
HTTP Public Key Pinning vs Certificate Transparency, which is better and why?
We are rolling out a new mobile app. Our security team recommends us to pin the public key in order to avoid MITM. iOS already has CT checks and we can enable that for the Android app as well.
The ...
- 171
3
votes
1
answer
572
views
How effective is Expect-CT against content inspection in an enterprise context?
HPKP was used to ensure that a browser accepts to connect to a site only if the public key he has on file is the one presented by the target site. I saw it as a way to make deep content inspection ...
- 9,078
1
vote
1
answer
196
views
Does the CT system "enforce" CA's to log issued certificates?
If a CA, who is otherwise acting good and participating in the Certificate Transparency system, were to issue a certificate without reporting it to any log, would this be noticed somehow?
I'm ...
2
votes
1
answer
551
views
Why isn't an Expect-CT violation report sent when I use a certificate generated with Burp Suite?
I wanted to test the Expect-CT security header. So I searched for sites and found that LinkedIn uses the Expect-CT header:
Expect-CT: max-age=86400, report-uri="https://www.linkedin.com/platform-...
- 21
3
votes
0
answers
349
views
How/When does Chrome queries Certificate Transparency (CT) log servers to ask for inclusion proof of certificates and how can I debug them?
I’ve been trying to understand how does Chrome interact with CT log servers. According to what I’ve read so far, Chrome sends inclusion proof requests (“GET https:///ct/v2/get-proof-by-hash” - https://...
- 31
0
votes
1
answer
148
views
local environment development and HTTPS: interaction with Chrome requirement of CT logs
The commonly suggested wisdom for local development environments with HTTPS is to use a self-created Root CA and use certificates issued from that CA. However, Chrome requires Certificate Transparancy ...
- 7,563
1
vote
2
answers
3k
views
What does "This request does not comply with Chrome's Certificate Transparency policy." in Chrome's Security Tab mean?
When you open up Chrome's DevTools and switch to the Security Tab you'll see the message This request does not comply with Chrome's Certificate Transparency policy. on some origins. (Example: https://...
- 1,438
6
votes
1
answer
871
views
How will Certificate Transparency be enforced?
The Chrome team has announced that "[they]’ll be moving forward with [their] plan to require Certificate Transparency for all newly issued, publicly trusted certificates starting in April 2018."
It's ...
- 425
3
votes
2
answers
3k
views
Where to get all the root CA certs?
Is there a common place where we can download all the root CA certs and get frequent updates for changes? This is one place where we can find the CAs, but we need to keep on checking for the updates. ...
- 203
9
votes
2
answers
813
views
How do I determine if a certificate in a CT log is my own?
I’m experimenting with scanning certificate transparency logs for my domains, and I’d like to filter out log entries for legitimately issued certificates so I only get alerts when someone else gets ...
- 253
14
votes
2
answers
890
views
Certificate transparency: should the certificate be submitted to ct-logs if the pre-certificate is already submitted
If a pre-certificate is generated and submitted to certificate transparency logs, the final certificate can include SCT receipts.
So the final certificate doesn't need to be submitted to ct-logs in ...
- 2,105
5
votes
2
answers
290
views
standards for regulation of intermediate Certificate authority
I want to know some information about the regulation of intermediate CAs. Is there any standard for intermediate CA to determine how many intermediate CAs are required or something like that which ...
- 51
2
votes
0
answers
370
views
Certificate Transparency and S/MIME certificates
When people speak about CT that usually means only TLS certificates are stored in log. However, CT probable might be considered for usage in other PKI-based technologies.
Is CT designed to log S/MIME ...
- 469
5
votes
1
answer
1k
views
What is the status of Certificate Transparency?
I am reading a bit on the certificate transparancy project initiazed by google. (More info at http://www.certificate-transparency.org), this technology tries to introduce transparency in the creation ...
- 343
2
votes
2
answers
948
views
Why does my Amazon-issued certificate not show up in the certificate transparency logs?
I have an Amazon-issued certificate (via AWS Certificate Manager) for a number of subdomains (CN = *.aws.jamymahabier.nl). However, it is not showing up in the logs at crt.sh (only the Let's Encrypt-...
- 123
2
votes
0
answers
967
views
ways to check a certificate fingerprint against known logs
Suppose I have a certificate sha-256 fingerprint, which I can obtain say visiting the relevant domain in firefox or from a shell script using openssl, and i want to verify this fingerprint. one option ...
- 379
2
votes
1
answer
2k
views
methods to check https certificates
I have a basic question regarding fingerprints of https certificates, the specific case I wanted to check being my online banking service. With firefox on linux, I can visit the specific web page and ...
- 379
22
votes
3
answers
20k
views
How can I access the certificate transparency logs?
Am I going crazy or is there no way to access any of the "known logs" listed on Google's Certificate Transparency site? Every single one of the links listed there 404s, even though the list is ...
- 331
5
votes
1
answer
2k
views
Certificate Transparency Android
For iOS-Apps, it is possible to use Certificate Transparency as stated here. We are developing native Apps for the different mobile platforms and are discussing to establish a more secure way of ...
- 175
4
votes
1
answer
1k
views
What exactly does certificate tranparency do?
I have huge problems to understand how certificate transparency is different from mechanism like CRL or OCSP which allow to get the status of a certificate by contacting the CA directly.
Which ...
- 1,492
7
votes
2
answers
580
views
How does Certificate Transparance detect fake or forked logs?
I am trying to understand Certificate Transparency.
Let's say I want to snoop on somebody's email. So I go hack or bribe a CA, have them issue a certificate for google.com, and then I present it when ...
- 173
1
vote
0
answers
1k
views
Certificate Transparency, TLS Extension method of serving SCT's
I was curious about how to supply certificate transparency from my web server.
There are 3 ways certificate transparency information can be delivered to the client's browser (Source:
http://www....
- 367
6
votes
3
answers
1k
views
Certificate Transparency
From what I read here, if the intermediate CA has been compromised, a fake cert can be issued and the privacy of the end-users could be compromised as well. In order to remediate this situation, ...
- 489