3 ms·
It's kind of labor-intensive! Like, in theory you can look at all of https://crt.sh/?Identity=%25&iCAID=7395 https://crt.sh/?Identity=%25&iCAID=7395 https://
by schoen 7y ago
It's kind of labor-intensive!
Like, in theory you can look at all of
https://crt.sh/?Identity=%25&iCAID=7395 https://crt.sh/?Identity=%25&iCAID=7395
https://crt.sh/?Identity=%25&iCAID=16418 https://crt.sh/?Identity=%25&iCAID=16418
to see all of them, and then find the billionth one. But wait, there are already 1.7 billion logged on just CAID 16418 alone...?
That's because of something called CT precertificates which are a weird hack where CAs may issue every certificate twice (once in a usable form and once in an unusable form) in order to facilitate CT logging verification. So some (but not all!) of those 1.7 billion are duplicates, which you can determine by excluding the ones that have the "precertificate poison" X.509 extension. Which I don't think crt.sh lets you do easily in this query interface.
Also, I think its interface can only show you results in log order rather than sorted by issuance date. So you would potentially need to do your own CT log parsing into a database in order to run this moderately complicated query, unless you can find someone else with a parsed CT log database who will let you run more specific database queries than crt.sh.
It's always weird when something computer-related is like "that data is public, but not currently present in a useful database schema that you can query to answer your exact question", but I think this is one of those cases!
- remram 7y agocrt.sh actually has their postgres database open to the public! You can connect with: psql -h crt.sh -p 5432 -U guest certwatch From what you're saying, the query would be: SELECT c.ID FROM certificate c WHERE (c.ISSUER_CA_ID = 16418 OR c.ISSUER_CA_ID = 7395) AND NOT x509_hasExtension(c.CERTIFICATE, '1.3.6.1.4.1.11129.2.4.3') OFFSET 1000000000 LIMIT 1; Unfortunately (but expectedly) it times out
- schoen 7y agoI don't know how I didn't know that -- thanks a ton for letting me know!