Skip to main content
Share Your Experience: Take the 2024 Developer Survey
18 votes
Accepted

How can I access the certificate transparency logs?

You can get the base URLs of known CT log providers from http://www.certificate-transparency.org/known-logs, however if you try to access that base URL, you'll just get a 404, instead you need to ...
Lie Ryan's user avatar
  • 31.4k
10 votes

Are we gossiping in Certificate Transparency?

Doesn't look like gossiping is going to happen at scale I think Emily Stark is in charge of CT on the Google Chrome side. And I think CT was largely a Google brainchild, so she is probably a good ...
StackzOfZtuff's user avatar
9 votes

How can I access the certificate transparency logs?

Is this what you're looking for? Google Transparency Report It gives you the ability to search the CT logs for all certs issued to a particular domain.
Mike Ounsworth's user avatar
7 votes

Are we gossiping in Certificate Transparency?

Searching for the term 'gossip' in the chromium and Firefox sources gives no relevant results. Nor can I find any other reference to gossip in browsers elsewhere. So I believe browsers have not ...
nobody's user avatar
  • 11.6k
7 votes
Accepted

What is the status of Certificate Transparency?

As of today (January 25, 2018), adoption of Certificate Transparency is not ubiquitous, but it is starting to gain momentum. Let's Encrypt logs all their certificates to CT logs, and several major CAs ...
Ajedi32's user avatar
  • 4,763
6 votes
Accepted

What exactly does certificate tranparency do?

Certificate Transparency solves a different problem from CRLs and OCSP. OCSP and CRLs handle the problem of certificate revocation. The CA is offering resolution for mistakes and bad actions on the ...
tylerl's user avatar
  • 83.5k
5 votes
Accepted

How do you get a CA trusted by Certificate Transparency logs?

So your question boils down to this: We are a small CA supported by some browsers. We are trying to offer EV certs but are running into issues because we're not logging our certs to CT logs. How can ...
Mike Ounsworth's user avatar
5 votes
Accepted

methods to check https certificates

Try this echo -n | openssl s_client -connect www.security.us.hsbc.com:443 2>/dev/null | openssl x509 -noout -fingerprint -sha256 The output should look like this: $ echo -n | openssl s_client -...
MikeSchem's user avatar
  • 2,351
4 votes

standards for regulation of intermediate Certificate authority

CABForum "Baseline Requirements" TLS certificates on The Web are governed primarily by the CA-Browser Forum Baseline Requirements, which all publicly-trusted CAs are required (by browser ...
Ajedi32's user avatar
  • 4,763
4 votes

How can I access the certificate transparency logs?

If you do interested in programmatic accessing CT logs then one possible way forward could be the lib I made CTjs. There you could find an an example how to use it - it is example using all possible ...
Yury Strozhevsky's user avatar
4 votes

Why isn't an Expect-CT violation report sent when I use a certificate generated with Burp Suite?

Certificate Transparency (CT) does not apply to non-public root Certificate Authorities. CT only validates that certificates issues by trusted public CAs were issued legitimately. Your Burp Suite ...
Dauntless's user avatar
  • 171
4 votes

How will Certificate Transparency be enforced?

Will certificates from corporate (or "internal") CAs be rejected by Chrome? This is already answered in the exact sentence you've cited: "... require Certificate Transparency for all newly issued, ...
Steffen Ullrich's user avatar
4 votes

Understanding Certificate Transparency in Mobile apps and How it Affects Traffic Proxying

will certificate transparency prevent this? No, it won't. Certificate Transparency is designed to catch CAs that issue malicious certificates. However, in your scenario, no malicious certificate has ...
nobody's user avatar
  • 11.6k
3 votes
Accepted

How effective is Expect-CT against content inspection in an enterprise context?

The aim of certificate pinning is to protect against malicious man in the middle attacks and not against legal content inspection as done in companies and also desktop antivirus for protection, where ...
Steffen Ullrich's user avatar
3 votes

Certificate Transparency logs: why are so many operated by same entities and how do they differ?

Why are some split into 202X series and what does the number mean? Since certificate transparency logs can grow to include hundreds of millions of certificates, they are often split into separate ...
nobody's user avatar
  • 11.6k
3 votes

Where to get all the root CA certs?

Depending on your application, you might not need "all" the CA certificates, but only the ones that you are able to trust. You can use the Mozilla CA Certificate Store at: https://www.mozilla.org/en-...
Daniel's user avatar
  • 371
3 votes
Accepted

Understanding Certificate Transparency in Mobile apps and How it Affects Traffic Proxying

Certificate Transparency (CT) and Certificate Pinning are different things for different purposes. Certificate Pinning is intended for an application to not let any non-pinned certificate to be used, ...
ThoriumBR's user avatar
  • 54.4k
2 votes
Accepted

Certificate Transparency Android

Although Conscrypt has code to support Certificate Transparency there doesn't seem to be an easy way to use this in an app as Google don't expose the API. It is possible to use Conscrypt as a ...
appmattus's user avatar
  • 136
2 votes

Certificate transparency: should the certificate be submitted to ct-logs if the pre-certificate is already submitted

it gives public confirmation that the certificate was indeed issued (and not only the pre-certificate) To quote RFC6962bis (draft-ietf-trans-rfc6962-bis-28), section 3.2: "signature" MUST ...
ximaera's user avatar
  • 3,486
2 votes
Accepted

local environment development and HTTPS: interaction with Chrome requirement of CT logs

From Announcement: Requiring Certificate Transparency ...: This past week at the 39th meeting of the CA/Browser Forum, the Chrome team announced plans that publicly trusted website certificates ...
Steffen Ullrich's user avatar
2 votes
Accepted

What does "This request does not comply with Chrome's Certificate Transparency policy." in Chrome's Security Tab mean?

Chrome's Certificate Transparency policy describes the number of distinct Google and non-Google logs that the certificate must have been logged to at the time it was issued. Certs with longer ...
Matt Slonetsky's user avatar
2 votes

How do you get a CA trusted by Certificate Transparency logs?

As described here: Google's first CT log.... Will log any certificate that is anchored in a root trusted by one of the major browser vendors. So I don't believe they'll accept arbitrary CAs. You ...
gowenfawr's user avatar
  • 72.8k
2 votes
Accepted

Submit a pre certificate to Certificate Transparency logs via APIs?

The operation of Certificate Transparency is specified in RFC 6962 and the submission method is specified in sections 4.1 and 4.2. A shortened version: 4.1. Add Chain to Log POST https://<log ...
Esa Jokinen's user avatar
2 votes

Certificate Transparency logs: why are so many operated by same entities and how do they differ?

As long as the logs are recognised by the browser/software validating the certificate it wont matter which log was used, for example known logs used by chrome would make a log not on the list somewhat ...
mcfedr's user avatar
  • 172
2 votes

Where to get all the root CA certs?

In short, no there is n't. A bit longer, there is no repository of all root CA's certificates. for example , private CA's are almost always not included in the CA list, also CA's with a limited ...
LvB's user avatar
  • 8,963
2 votes

How does the certificate transparency check in Chrome work?

The browser generally requires the website to provide an SCT (Signed Certificate Timestamp) signed by the logs which have logged the certificate. This means that while the browser may not immediately ...
nobody's user avatar
  • 11.6k
2 votes
Accepted

Does the wildcard certificates registered late?

That's a DNS question more than a certificate question. The *. wildcard in a Subject Alternative Name dNSName entry doesn't expand to all the subdomains that were valid when the certificate was issued,...
bartonjs's user avatar
  • 1,878
1 vote

CT logs for non browser applications

Is it up to the program developer to implement this? that's correct, it is up to developer to include CT log support in non-browser applications. CT Logs are required by CA/Browser Forum and this ...
Crypt32's user avatar
  • 6,391
1 vote
Accepted

Adding Expect-CT header to HTTP response

Because I don't have uri here, the report will not be sent, so there is no additional security at all. You are right. In case enforced is not specified, as in your case, and browser detects a CT ...
mentallurg's user avatar
  • 12.4k
1 vote

HTTP Public Key Pinning vs Certificate Transparency, which is better and why?

they won’t be able to use the app If this is true, it means your application design is not good. One of solutions is that if you switch key you should also provide a new end point. For the transition ...
mentallurg's user avatar
  • 12.4k

Only top scored, non community-wiki answers of a minimum length are eligible