I'm trying to understand how Certificate Transparency solves the problem with dishonest Certificate Authorities embedding an SCT in their certificates. I understand that the log is append-only, and server can "prove" that the certificate was indeed logged.
Suppose I'm a rogue CA, and I want to issue a certificate but also log it to a couple of logs. I create a certificate for a domain name that nobody cares about (say foobar.com
), and submit the precertificate to the logs. I can then get the SCT back. I can then remove the poison extension, and add another domain name (say, paypal.com
) to the SAN field, and then issue the certificate.
Is there any mechanism that prevents me from doing this? Anyone scanning CT logs will not see that I issued a certificate for paypal.com
, but the browsers are supposed to trust the certificate and will also believe that I have submitted the certificate to the log.
The very objective of CT is to prevent CAs from issuing certificates for what it should not. I'm sure there are baseline requirements that prevents this and the CA would be removed from the trusted roots if they are caught doing this. But is there any cryptographically secure way to prevent this?