4 ms·
> these certificates were already being rejected by Chrome and Safari for having invalid SCTs What's a good way to make an equivalent check from a script, if I
by mjw1007 3y ago
> these certificates were already being rejected by Chrome and Safari for having invalid SCTs
What's a good way to make an equivalent check from a script, if I want (in future) to be able to check whether I have a website whose certificate has such a problem?
- agwa 3y agoExcellent question! The sctcheck command from https://github.com/google/certificate-transparency-go/ https://github.com/google/certificate-transparency-go/ can be used to check the signatures of the embedded SCTs in a certificate. I've also got an online tool which you can use to test a site for CT policy compliance: https://sslmate.com/labs/ct_policy_analyzer/ https://sslmate.com/labs/ct_policy_analyzer/ Example of a working site: https://sslmate.com/labs/ct_policy_analyzer/?sslmate.com https://sslmate.com/labs/ct_policy_analyzer/?sslmate.com Example of one of the sites affected by the Let's Encrypt incident: https://sslmate.com/labs/ct_policy_analyzer/?thecandyshake.com https://sslmate.com/labs/ct_policy_analyzer/?thecandyshake.c...