Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [certificate-transparency]

a system where Certificate Authorities are required to log all certs they issue to one or more Certificate Transparency Logs, which are publicly accessible. The purpose is to add additional accountability for CAs, and allow easy searching of all certificates issued to a domain.

Filter by
Sorted by
Tagged with
0 votes
1 answer
428 views

crt.sh shows certificates for domains I don't recognize

Today I learned of the existence of crt.sh. I typed one of my domain names into the search box to find out what it returns. I found a lot of certificate entries for domains that I don't recognize, and ...
Scott Severance's user avatar
0 votes
2 answers
214 views

What prevents certificate authorities from issuing fraudulent TLS certificates?

There have been reports of attacks against certificate authorities resulting in the issuance of fraudulent TLS certificates for sites such as google.com, yahoo.com, and skype.com. These attacks seem ...
Gilgamesh's user avatar
0 votes
0 answers
40 views

How does Certificate Transparency protect from hacked CA server [duplicate]

I was able to grasp how CT works by reading this explanation, but one thing remains unclear for me - how CT may protect ecosystem from hacked CA server. For example, someone hacked Digicert, and now ...
Ghost Rider's user avatar
2 votes
1 answer
909 views

How to create and embed Signed Certificate Timestamp (SCT) in certificate

I have deployed a Certificate Transparency (CT) log server that uses Google's CTFE (named "certificate-transparency-go" on Github) and Trillian Projects. And I have issued a pre-certificate, ...
Levi Marvin's user avatar
1 vote
1 answer
143 views

Comparing ACME client logs against Certificate Transparency logs

Inspired by this comment from Can DDNS provider perform a MITM attack?, I was wondering if there is an automated way to check the Certificate Transparency logs for malicious/unexpected certificates. ...
oliver's user avatar
  • 581
0 votes
1 answer
86 views

Does the wildcard certificates registered late?

I've been trying to understand the process how the certificates are being registered and wildcard certificates got my attention. For some companies that offer free hosting in their site, I noticed ...
glovescoffee's user avatar
3 votes
0 answers
132 views

What is expected of domain owners in the Certificate Transparency system?

As I understand it, Certificate Transparancy provides proof to the client that the presented certificate is publicly accessible in CT logs. The certificate being in the logs enables a domain owner to ...
JazZeus's user avatar
  • 53
2 votes
1 answer
2k views

How does the certificate transparency check in Chrome work?

I've been reading up on Certificate Transparency (CT), but can't find anywhere how a client (like a browser) is supposed to check if the certificate is present in any of the certificate transparency ...
JazZeus's user avatar
  • 53
4 votes
2 answers
1k views

Understanding Certificate Transparency in Mobile apps and How it Affects Traffic Proxying

I am familiar with the basics of CT and certificate pinning. However, I'm failing to understand how CT properly replaces pinning in mobile apps in a scenario in which, for example, an attacker steals ...
CT-Asker's user avatar
2 votes
0 answers
227 views

What are the risks of trusting a certificate that is not logged in CT logs?

A website that I do banking on has a login page on a different subdomain than their main website, and this login page is secured with an Amazon-issued domain-validation certificate (their main website ...
huanglx's user avatar
  • 175
23 votes
2 answers
4k views

Are we gossiping in Certificate Transparency?

Ben Laurie's original paper on Certificate Transparency proposed that clients (browsers) should "gossip". In particular, it proposed that when a browser connects to a web server, it should ...
D.W.'s user avatar
  • 99.8k
0 votes
1 answer
136 views

CT logs for non browser applications

Most what I read on CT logs is about browsers checking the logs for websites. But what about normal applications or updates for operating systems (like apt-get over https, windows/osx updates ...) Is ...
vilkas's user avatar
  • 19
4 votes
2 answers
890 views

How do you get a CA trusted by Certificate Transparency logs?

How would one go about getting in contact with a popular CT logs operator's, let's say Google Pilot, and how would one get a CA root included in their log? Are there open CT logs that allow untrusted ...
Nathanna's user avatar
0 votes
1 answer
316 views

Submit a pre certificate to Certificate Transparency logs via APIs?

How would a CA submit a certificate to Certificate Transparency logs? Preferably Google's Pilot or Rocketeer CT. Would one submit via an API, SDK, library? If submitting should it be a render of a ...
Nathanna's user avatar
2 votes
0 answers
185 views

OCSP responder that returns embedded SCTs

There are three ways for a TLS client to obtain Signed Certficiate Timestamps (SCTs): During the TLS handshake itself using the SCT List extension As embedded precertificate SCTs in the leaf ...
jnsp's user avatar
  • 405
7 votes
2 answers
5k views

Certificate Transparency logs: why are so many operated by same entities and how do they differ?

I'm trying to understand the point of having multiple Certificate Transparency logs. While I understand that it solves the problems of reliability of trust, what baffles me is that so many are ...
d33tah's user avatar
  • 6,554
1 vote
2 answers
356 views

Why infamous Addtrust certificate is still not expired (same private key) for code signing?

As many of you know Addtrust certificate https://crt.sh/?id=1 expired 30 May 2020 as well as many other intermediate certs and now we have to update certs on many servers to either root cert https://...
Валерий Заподовников's user avatar
4 votes
1 answer
3k views

Adding Expect-CT header to HTTP response

In the security test report, I have a recommendation to add Expect-CT header to the HTTP response from web application, additionally developers set this to: Expect-CT: max-age=0, report-uri= I am ...
user187205's user avatar
  • 1,333
7 votes
2 answers
3k views

HTTP Public Key Pinning vs Certificate Transparency, which is better and why?

We are rolling out a new mobile app. Our security team recommends us to pin the public key in order to avoid MITM. iOS already has CT checks and we can enable that for the Android app as well. The ...
Aman's user avatar
  • 171
3 votes
1 answer
552 views

How effective is Expect-CT against content inspection in an enterprise context?

HPKP was used to ensure that a browser accepts to connect to a site only if the public key he has on file is the one presented by the target site. I saw it as a way to make deep content inspection ...
WoJ's user avatar
  • 9,038
1 vote
1 answer
189 views

Does the CT system "enforce" CA's to log issued certificates?

If a CA, who is otherwise acting good and participating in the Certificate Transparency system, were to issue a certificate without reporting it to any log, would this be noticed somehow? I'm ...
Filip Nilsson's user avatar
2 votes
1 answer
546 views

Why isn't an Expect-CT violation report sent when I use a certificate generated with Burp Suite?

I wanted to test the Expect-CT security header. So I searched for sites and found that LinkedIn uses the Expect-CT header: Expect-CT: max-age=86400, report-uri="https://www.linkedin.com/platform-...
Ivanov's user avatar
  • 21
3 votes
0 answers
338 views

How/When does Chrome queries Certificate Transparency (CT) log servers to ask for inclusion proof of certificates and how can I debug them?

I’ve been trying to understand how does Chrome interact with CT log servers. According to what I’ve read so far, Chrome sends inclusion proof requests (“GET https:///ct/v2/get-proof-by-hash” - https://...
flopoe's user avatar
  • 31
0 votes
1 answer
145 views

local environment development and HTTPS: interaction with Chrome requirement of CT logs

The commonly suggested wisdom for local development environments with HTTPS is to use a self-created Root CA and use certificates issued from that CA. However, Chrome requires Certificate Transparancy ...
Nzall's user avatar
  • 7,423
1 vote
2 answers
2k views

What does "This request does not comply with Chrome's Certificate Transparency policy." in Chrome's Security Tab mean?

When you open up Chrome's DevTools and switch to the Security Tab you'll see the message This request does not comply with Chrome's Certificate Transparency policy. on some origins. (Example: https://...
HorstKevin's user avatar
  • 1,428
6 votes
1 answer
847 views

How will Certificate Transparency be enforced?

The Chrome team has announced that "[they]’ll be moving forward with [their] plan to require Certificate Transparency for all newly issued, publicly trusted certificates starting in April 2018." It's ...
jornane's user avatar
  • 425
3 votes
2 answers
2k views

Where to get all the root CA certs?

Is there a common place where we can download all the root CA certs and get frequent updates for changes? This is one place where we can find the CAs, but we need to keep on checking for the updates. ...
Prakhash's user avatar
  • 203
9 votes
2 answers
784 views

How do I determine if a certificate in a CT log is my own?

I’m experimenting with scanning certificate transparency logs for my domains, and I’d like to filter out log entries for legitimately issued certificates so I only get alerts when someone else gets ...
Wolfgang's user avatar
  • 253
14 votes
2 answers
868 views

Certificate transparency: should the certificate be submitted to ct-logs if the pre-certificate is already submitted

If a pre-certificate is generated and submitted to certificate transparency logs, the final certificate can include SCT receipts. So the final certificate doesn't need to be submitted to ct-logs in ...
Tom's user avatar
  • 2,105
5 votes
2 answers
277 views

standards for regulation of intermediate Certificate authority

I want to know some information about the regulation of intermediate CAs. Is there any standard for intermediate CA to determine how many intermediate CAs are required or something like that which ...
e.re's user avatar
  • 51
2 votes
0 answers
342 views

Certificate Transparency and S/MIME certificates

When people speak about CT that usually means only TLS certificates are stored in log. However, CT probable might be considered for usage in other PKI-based technologies. Is CT designed to log S/MIME ...
tysonite's user avatar
  • 469
5 votes
1 answer
1k views

What is the status of Certificate Transparency?

I am reading a bit on the certificate transparancy project initiazed by google. (More info at http://www.certificate-transparency.org), this technology tries to introduce transparency in the creation ...
KojoUzochi's user avatar
2 votes
2 answers
926 views

Why does my Amazon-issued certificate not show up in the certificate transparency logs?

I have an Amazon-issued certificate (via AWS Certificate Manager) for a number of subdomains (CN = *.aws.jamymahabier.nl). However, it is not showing up in the logs at crt.sh (only the Let's Encrypt-...
Jamy Mahabier's user avatar
2 votes
0 answers
937 views

ways to check a certificate fingerprint against known logs

Suppose I have a certificate sha-256 fingerprint, which I can obtain say visiting the relevant domain in firefox or from a shell script using openssl, and i want to verify this fingerprint. one option ...
jj_p's user avatar
  • 379
2 votes
1 answer
1k views

methods to check https certificates

I have a basic question regarding fingerprints of https certificates, the specific case I wanted to check being my online banking service. With firefox on linux, I can visit the specific web page and ...
jj_p's user avatar
  • 379
21 votes
3 answers
19k views

How can I access the certificate transparency logs?

Am I going crazy or is there no way to access any of the "known logs" listed on Google's Certificate Transparency site? Every single one of the links listed there 404s, even though the list is ...
user124384's user avatar
5 votes
1 answer
2k views

Certificate Transparency Android

For iOS-Apps, it is possible to use Certificate Transparency as stated here. We are developing native Apps for the different mobile platforms and are discussing to establish a more secure way of ...
Supahupe's user avatar
  • 175
4 votes
1 answer
1k views

What exactly does certificate tranparency do?

I have huge problems to understand how certificate transparency is different from mechanism like CRL or OCSP which allow to get the status of a certificate by contacting the CA directly. Which ...
user2284570's user avatar
  • 1,472
7 votes
2 answers
568 views

How does Certificate Transparance detect fake or forked logs?

I am trying to understand Certificate Transparency. Let's say I want to snoop on somebody's email. So I go hack or bribe a CA, have them issue a certificate for google.com, and then I present it when ...
Tor Klingberg's user avatar
1 vote
0 answers
1k views

Certificate Transparency, TLS Extension method of serving SCT's

I was curious about how to supply certificate transparency from my web server. There are 3 ways certificate transparency information can be delivered to the client's browser (Source: http://www....
Breakhty's user avatar
  • 367
6 votes
3 answers
1k views

Certificate Transparency

From what I read here, if the intermediate CA has been compromised, a fake cert can be issued and the privacy of the end-users could be compromised as well. In order to remediate this situation, ...
Ryu's user avatar
  • 489