Questions tagged [certificate-transparency]

a system where Certificate Authorities are required to log all certs they issue to one or more Certificate Transparency Logs, which are publicly accessible. The purpose is to add additional accountability for CAs, and allow easy searching of all certificates issued to a domain.

Certificate Transparency is a system where Certificate Authorities are required to log all certs they issue to one or more Certificate Transparency Logs, which are publicly accessible. The purpose is to add additional accountability for CAs, and allow easy searching of all certificates issued to a domain.

CT was brought in partly to make it easier to catch CAs intentionally issuing fraudulent certs, and partly to allow web site administrators to monitor when a cert is issued to their domain that they did not request. Google maintains a Transparency Report page where you can search the logs for all certificates issued to a particular domain:

Google Transparency Report

This is a project introduced by Google, and they still run the project.

39 questions
1
vote
2 answers

Why infamous Addtrust certificate is still not expired (same private key) for code signing?

As many of you know Addtrust certificate https://crt.sh/?id=1 expired 30 May 2020 as well as many other intermediate certs and now we have to update certs on many servers to either root cert https://crt.sh/?id=1199354 or using another chain with…
1
vote
1 answer

Does the CT system "enforce" CA's to log issued certificates?

If a CA, who is otherwise acting good and participating in the Certificate Transparency system, were to issue a certificate without reporting it to any log, would this be noticed somehow? I'm thinking the answer to this is no, but I'm not…
0
votes
0 answers

How does Certificate Transparency protect from hacked CA server

I was able to grasp how CT works by reading this explanation, but one thing remains unclear for me - how CT may protect ecosystem from hacked CA server. For example, someone hacked Digicert, and now from it behaves issues EV or regular certificates…
0
votes
1 answer

How to create and embed Signed Certificate Timestamp (SCT) in certificate

I have deployed a Certificate Transparency (CT) log server that uses Google's CTFE (named "certificate-transparency-go" on Github) and Trillian Projects. And I have issued a pre-certificate, submitted to my own CT log server. I have this text…
0
votes
1 answer

Does the wildcard certificates registered late?

I've been trying to understand the process how the certificates are being registered and wildcard certificates got my attention. For some companies that offer free hosting in their site, I noticed that clients with free accounts can also have a…
0
votes
1 answer

CT logs for non browser applications

Most what I read on CT logs is about browsers checking the logs for websites. But what about normal applications or updates for operating systems (like apt-get over https, windows/osx updates ...) Is checking CT logs mandatory for those too? Is it…
0
votes
1 answer

Submit a pre certificate to Certificate Transparency logs via APIs?

How would a CA submit a certificate to Certificate Transparency logs? Preferably Google's Pilot or Rocketeer CT. Would one submit via an API, SDK, library? If submitting should it be a render of a certificate (without log extensions) or the final…
0
votes
1 answer

local environment development and HTTPS: interaction with Chrome requirement of CT logs

The commonly suggested wisdom for local development environments with HTTPS is to use a self-created Root CA and use certificates issued from that CA. However, Chrome requires Certificate Transparancy since about a year now, with a warning for sites…
Nzall
  • 7,313
  • 6
  • 29
  • 45
0
votes
2 answers

What does "This request does not comply with Chrome's Certificate Transparency policy." in Chrome's Security Tab mean?

When you open up Chrome's DevTools and switch to the Security Tab you'll see the message This request does not comply with Chrome's Certificate Transparency policy. on some origins. (Example: https://de.ioam.de when you visit…
HorstKevin
  • 1,328
  • 2
  • 14
  • 27
1 2
3