3 ms·

That was really interesting to read. As a relative layment in this area. Do you have any recommendations on reading material in this area? How is your monitorin

That was really interesting to read. As a relative layment in this area. Do you have any recommendations on reading material in this area? How is your monitoring setup?

tialaramex 7y ago
An earlier edit of your post seems like you didn't understand enough about how X.500 Distinguished Names work to search the DNs (presumably in crt.sh) so learning about that might not be time wasted if you care what's inside a certificate other than domain names. Be warned that although the CAs are required by CA/B rules to get most of those other details right when they're included there is limited appetite for enforcing such a rule. There are Google Groups (because a lot of this is a Google project or spins out of Google projects) for a lot of this, including mozilla.dev.security.policy (the public discussion of Mozilla's root trust store policy), certificate-transparency (general discussion of CT) and crtsh (discussion of Rob's crt.sh monitor database and site). They're all usually quiet enough that you could read back a few months and/or subscribe and have them in your background.
- rurounijones 7y ago
  Yes, sorry abut the edit, I thught I was quick enough to ermove it before anyone read it as I figured out what I was doing wrong. Thank you very much for the links.
agwa 7y ago
https://blog.cloudflare.com/introducing-certificate-transparency-and-nimbus/ https://blog.cloudflare.com/introducing-certificate-transpar... is a very good overview of Certificate Transparency. I've written my own Certificate Transparency monitor called Cert Spotter. I use both the standalone open source version (https://github.com/SSLMate/certspotter https://github.com/SSLMate/certspotter) and the hosted service (https://sslmate.com/certspotter https://sslmate.com/certspotter) to monitor my own domains as well as several test/example domains (example.com, test.com, etc.).

That was really interesting to read. As a relative layment in this area. Do you have any recommendations on reading material in this area? How is your monitoring setup?

tialaramex 7y ago

An earlier edit of your post seems like you didn't understand enough about how X.500 Distinguished Names work to search the DNs (presumably in crt.sh) so learning about that might not be time wasted if you care what's inside a certificate other than domain names. Be warned that although the CAs are required by CA/B rules to get most of those other details right when they're included there is limited appetite for enforcing such a rule. There are Google Groups (because a lot of this is a Google project or spins out of Google projects) for a lot of this, including mozilla.dev.security.policy (the public discussion of Mozilla's root trust store policy), certificate-transparency (general discussion of CT) and crtsh (discussion of Rob's crt.sh monitor database and site). They're all usually quiet enough that you could read back a few months and/or subscribe and have them in your background.

rurounijones 7y ago
Yes, sorry abut the edit, I thught I was quick enough to ermove it before anyone read it as I figured out what I was doing wrong. Thank you very much for the links.

agwa 7y ago

https://blog.cloudflare.com/introducing-certificate-transparency-and-nimbus/ https://blog.cloudflare.com/introducing-certificate-transpar... is a very good overview of Certificate Transparency. I've written my own Certificate Transparency monitor called Cert Spotter. I use both the standalone open source version (https://github.com/SSLMate/certspotter https://github.com/SSLMate/certspotter) and the hosted service (https://sslmate.com/certspotter https://sslmate.com/certspotter) to monitor my own domains as well as several test/example domains (example.com, test.com, etc.).