Skip to main content

Questions tagged [certificate-transparency]

a system where Certificate Authorities are required to log all certs they issue to one or more Certificate Transparency Logs, which are publicly accessible. The purpose is to add additional accountability for CAs, and allow easy searching of all certificates issued to a domain.

9 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3 votes
0 answers
137 views

What is expected of domain owners in the Certificate Transparency system?

As I understand it, Certificate Transparancy provides proof to the client that the presented certificate is publicly accessible in CT logs. The certificate being in the logs enables a domain owner to ...
JazZeus's user avatar
  • 53
3 votes
0 answers
341 views

How/When does Chrome queries Certificate Transparency (CT) log servers to ask for inclusion proof of certificates and how can I debug them?

I’ve been trying to understand how does Chrome interact with CT log servers. According to what I’ve read so far, Chrome sends inclusion proof requests (“GET https:///ct/v2/get-proof-by-hash” - https://...
flopoe's user avatar
  • 31
2 votes
0 answers
234 views

What are the risks of trusting a certificate that is not logged in CT logs?

A website that I do banking on has a login page on a different subdomain than their main website, and this login page is secured with an Amazon-issued domain-validation certificate (their main website ...
huanglx's user avatar
  • 175
2 votes
0 answers
188 views

OCSP responder that returns embedded SCTs

There are three ways for a TLS client to obtain Signed Certficiate Timestamps (SCTs): During the TLS handshake itself using the SCT List extension As embedded precertificate SCTs in the leaf ...
jnsp's user avatar
  • 405
2 votes
0 answers
351 views

Certificate Transparency and S/MIME certificates

When people speak about CT that usually means only TLS certificates are stored in log. However, CT probable might be considered for usage in other PKI-based technologies. Is CT designed to log S/MIME ...
tysonite's user avatar
  • 469
2 votes
0 answers
947 views

ways to check a certificate fingerprint against known logs

Suppose I have a certificate sha-256 fingerprint, which I can obtain say visiting the relevant domain in firefox or from a shell script using openssl, and i want to verify this fingerprint. one option ...
jj_p's user avatar
  • 379
1 vote
1 answer
148 views

Comparing ACME client logs against Certificate Transparency logs

Inspired by this comment from Can DDNS provider perform a MITM attack?, I was wondering if there is an automated way to check the Certificate Transparency logs for malicious/unexpected certificates. ...
oliver's user avatar
  • 601
1 vote
2 answers
363 views

Why infamous Addtrust certificate is still not expired (same private key) for code signing?

As many of you know Addtrust certificate https://crt.sh/?id=1 expired 30 May 2020 as well as many other intermediate certs and now we have to update certs on many servers to either root cert https://...
Валерий Заподовников's user avatar
1 vote
0 answers
1k views

Certificate Transparency, TLS Extension method of serving SCT's

I was curious about how to supply certificate transparency from my web server. There are 3 ways certificate transparency information can be delivered to the client's browser (Source: http://www....
Breakhty's user avatar
  • 367