The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [certificate-transparency]

a system where Certificate Authorities are required to log all certs they issue to one or more Certificate Transparency Logs, which are publicly accessible. The purpose is to add additional accountability for CAs, and allow easy searching of all certificates issued to a domain.

Filter by
Sorted by
Tagged with
0
votes
1answer
29 views

How effective is Expect-CT against content inspection in an enterprise context?

HPKP was used to ensure that a browser accepts to connect to a site only if the public key he has on file is the one presented by the target site. I saw it as a way to make deep content inspection ...
2
votes
1answer
45 views

Does the CT system “enforce” CA's to log issued certificates?

If a CA, who is otherwise acting good and participating in the Certificate Transparency system, were to issue a certificate without reporting it to any log, would this be noticed somehow? I'm ...
2
votes
1answer
103 views

Why isn't an Expect-CT violation report sent when I use a certificate generated with Burp Suite?

I wanted to test the Expect-CT security header. So I searched for sites and found that LinkedIn uses the Expect-CT header: Expect-CT: max-age=86400, report-uri="https://www.linkedin.com/platform-...
1
vote
0answers
57 views

How/When does Chrome queries Certificate Transparency (CT) log servers to ask for inclusion proof of certificates and how can I debug them?

I’ve been trying to understand how does Chrome interact with CT log servers. According to what I’ve read so far, Chrome sends inclusion proof requests (“GET https:///ct/v2/get-proof-by-hash” - https://...
1
vote
1answer
63 views

local environment development and HTTPS: interaction with Chrome requirement of CT logs

The commonly suggested wisdom for local development environments with HTTPS is to use a self-created Root CA and use certificates issued from that CA. However, Chrome requires Certificate Transparancy ...
0
votes
2answers
268 views

What does “This request does not comply with Chrome's Certificate Transparency policy.” in Chrome's Security Tab mean?

When you open up Chrome's DevTools and switch to the Security Tab you'll see the message This request does not comply with Chrome's Certificate Transparency policy. on some origins. (Example: https://...
4
votes
1answer
380 views

How will Certificate Transparency be enforced?

The Chrome team has announced that "[they]’ll be moving forward with [their] plan to require Certificate Transparency for all newly issued, publicly trusted certificates starting in April 2018." It's ...
3
votes
2answers
382 views

Where to get all the root CA certs?

Is there a common place where we can download all the root CA certs and get frequent updates for changes? This is one place where we can find the CAs, but we need to keep on checking for the updates. ...
8
votes
2answers
268 views

How do I determine if a certificate in a CT log is my own?

I’m experimenting with scanning certificate transparency logs for my domains, and I’d like to filter out log entries for legitimately issued certificates so I only get alerts when someone else gets ...
12
votes
2answers
467 views

Certificate transparency: should the certificate be submitted to ct-logs if the pre-certificate is already submitted

If a pre-certificate is generated and submitted to certificate transparency logs, the final certificate can include SCT receipts. So the final certificate doesn't need to be submitted to ct-logs in ...
5
votes
2answers
122 views

standards for regulation of intermediate Certificate authority

I want to know some information about the regulation of intermediate CAs. Is there any standard for intermediate CA to determine how many intermediate CAs are required or something like that which ...
2
votes
0answers
114 views

Certificate Transparency and S/MIME certificates

When people speak about CT that usually means only TLS certificates are stored in log. However, CT probable might be considered for usage in other PKI-based technologies. Is CT designed to log S/MIME ...
5
votes
1answer
907 views

What is the status of Certificate Transparency?

I am reading a bit on the certificate transparancy project initiazed by google. (More info at http://www.certificate-transparency.org), this technology tries to introduce transparency in the creation ...
2
votes
2answers
637 views

Why does my Amazon-issued certificate not show up in the certificate transparency logs?

I have an Amazon-issued certificate (via AWS Certificate Manager) for a number of subdomains (CN = *.aws.jamymahabier.nl). However, it is not showing up in the logs at crt.sh (only the Let's Encrypt-...
1
vote
0answers
516 views

ways to check a certificate fingerprint against known logs

Suppose I have a certificate sha-256 fingerprint, which I can obtain say visiting the relevant domain in firefox or from a shell script using openssl, and i want to verify this fingerprint. one option ...
2
votes
1answer
704 views

methods to check https certificates

I have a basic question regarding fingerprints of https certificates, the specific case I wanted to check being my online banking service. With firefox on linux, I can visit the specific web page and ...
12
votes
3answers
8k views

How can I access the certificate transparency logs?

Am I going crazy or is there no way to access any of the "known logs" listed on Google's Certificate Transparency site? Every single one of the links listed there 404s, even though the list is ...
3
votes
1answer
691 views

Certificate Transparency Android

For iOS-Apps, it is possible to use Certificate Transparency as stated here. We are developing native Apps for the different mobile platforms and are discussing to establish a more secure way of ...
4
votes
1answer
244 views

What exactly does certificate tranparency do?

I have huge problems to understand how certificate transparency is different from mechanism like CRL or OCSP which allow to get the status of a certificate by contacting the CA directly. Which ...
5
votes
2answers
232 views

How does Certificate Transparance detect fake or forked logs?

I am trying to understand Certificate Transparency. Let's say I want to snoop on somebody's email. So I go hack or bribe a CA, have them issue a certificate for google.com, and then I present it when ...
1
vote
0answers
1k views

Certificate Transparency, TLS Extension method of serving SCT's

I was curious about how to supply certificate transparency from my web server. There are 3 ways certificate transparency information can be delivered to the client's browser (Source: http://www....
5
votes
3answers
1k views

Certificate Transparency

From what I read here, if the intermediate CA has been compromised, a fake cert can be issued and the privacy of the end-users could be compromised as well. In order to remediate this situation, ...