3 ms·
No, that's not a valid conclusion. Browsers do not query log servers in real-time whenever they see a new certificate. Rather, servers send SCTs which are "a pr
by pfg 10y ago
No, that's not a valid conclusion. Browsers do not query log servers in real-time whenever they see a new certificate. Rather, servers send SCTs which are "a promise to add the certificate to the log within some time period"[1]. Comparatively speaking, think of this more like OCSP stapling as opposed to real-time OCSP queries.
Auditors and CT gossiping are responsible for ensuring that the log servers are not misbehaving.
[1]: http://www.certificate-transparency.org/how-ct-works http://www.certificate-transparency.org/how-ct-works
- xnyhps 10y agoCorrect. What might be interesting to add to this: you can't query Certificate Transparency servers by certificate. You can query them by index or by using an SCT hash, but if you want a definitive answer to "when was this certificate first logged?" you'll need to process the log completely. CT is not designed for live-checking of certificates, only for monitoring by domain owners.