#certificatetransparency — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #certificatetransparency, aggregated by home.social.
-
Must be some kind of record! 6 seconds between getting issued a LetsEncrypt certificate and a dodgy IP from Romania (reported by abuseipdb.com) to hit the web server via hostname.
18.141.219.235 [26/Jun/2026:10:45:12 +01:00] "GET /.well-known/acme-challenge/... HTTP/1.1"... "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
80.94.92.7 [26/Jun/2026:10:45:18 +01:00] "GET / HTTP/1.1"
Insane. The only way to combat this nonsense is to use only wildcard certificates.
-
Must be some kind of record! 6 seconds between getting issued a LetsEncrypt certificate and a dodgy IP from Romania (reported by abuseipdb.com) to hit the web server via hostname.
18.141.219.235 [26/Jun/2026:10:45:12 +01:00] "GET /.well-known/acme-challenge/... HTTP/1.1"... "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
80.94.92.7 [26/Jun/2026:10:45:18 +01:00] "GET / HTTP/1.1"
Insane. The only way to combat this nonsense is to use only wildcard certificates.
-
Is anyone aware of an alternative to crt.sh ? I really like the website, and it's simple visualization. No bloat around it, just the pure purpose of providing insights from CT logs.
However, the website quite often returns server errors, and others. More often than it did in the past, a few years ago. My hope is, to find a similarly informative tool that is however a bit more reliable.
I dislike it if I have to put down a note to re-check a domain's certificate history and to remember just because the service was down by the time I was interested in the information.
#certificates #tls #ssl #certificatetransparency #logs #bigdata #https
-
Is anyone aware of an alternative to crt.sh ? I really like the website, and it's simple visualization. No bloat around it, just the pure purpose of providing insights from CT logs.
However, the website quite often returns server errors, and others. More often than it did in the past, a few years ago. My hope is, to find a similarly informative tool that is however a bit more reliable.
I dislike it if I have to put down a note to re-check a domain's certificate history and to remember just because the service was down by the time I was interested in the information.
#certificates #tls #ssl #certificatetransparency #logs #bigdata #https
-
Just learned that Certificate Transparency logs are a thing... I hate it. One day, and a private subdomain is crawled by AI scrapers. These bas***ds...
At least some of them are being trapped by iocaine
#LetsEncrypt #CertificateTransparency #FckAI #FuckLLMs #caddy #iocaine
-
Just learned that Certificate Transparency logs are a thing... I hate it. One day, and a private subdomain is crawled by AI scrapers. These bas***ds...
At least some of them are being trapped by iocaine
#LetsEncrypt #CertificateTransparency #FckAI #FuckLLMs #caddy #iocaine
-
AI Infrastructure Exposes Widespread Security Gaps
A staggering 2 million hosts and 1 million exposed services were uncovered through a simple scan of certificate transparency logs, revealing alarming security gaps in AI infrastructure. The findings painted a concerning picture: most AI projects lack even basic authentication, leaving them vulnerable to…
#AiInfrastructure #CertificateTransparency #ExposedServices #MisconfiguredServices #AuthenticationBypass
-
Google Chrome plots a quantum-safe future for HTTPS
https://fed.brid.gy/r/https://nerds.xyz/2026/02/chrome-quantum-safe-https-mtc/
-
Today I published an update on the #Canonical supported #upki project, which brings browser-grade Public Key Infrastructure to Linux through the efficient #CRLite data format, with the core revocation engine now functional and available to test!
Beyond current progress, this post explores broader integration, performance, and future capabilities like Certificate Transparency enforcement and Merkle Tree.
This is all part of the effort to increase the resilience of #Ubuntu machines by default, but I hope it has a wider benefit on the Linux ecosystem going forward!
-
Today I published an update on the #Canonical supported #upki project, which brings browser-grade Public Key Infrastructure to Linux through the efficient #CRLite data format, with the core revocation engine now functional and available to test!
Beyond current progress, this post explores broader integration, performance, and future capabilities like Certificate Transparency enforcement and Merkle Tree.
This is all part of the effort to increase the resilience of #Ubuntu machines by default, but I hope it has a wider benefit on the Linux ecosystem going forward!
-
It seems that OpenAI is scraping [certificate transparency] logs
https://benjojo.co.uk/u/benjojo/h/Gxy2qrCkn1Y327Y6D3
#HackerNews #OpenAI #CertificateTransparency #Scraping #Technology #News #HackerNews
-
It seems that OpenAI is scraping [certificate transparency] logs
https://benjojo.co.uk/u/benjojo/h/Gxy2qrCkn1Y327Y6D3
#HackerNews #OpenAI #CertificateTransparency #Scraping #Technology #News #HackerNews
-
Eric Brandes dropped Part 2 of our CT logs series. The performance gap is staggering.
Tiled logs: 100M+ records/day
RFC 6962: Low millions (with throttling)Google throttles hard. Cloudflare's Nimbus is decent. Let's Encrypt's tiled logs absolutely fly.
Post includes working Golang code for both log types. Real implementations, not theory.
-
Certificate Transparency logs hold billions of certificates but searching them is brutal. crt.sh is slow, truncates results, and crashes constantly.
We built a better CT search tool at CertKit (free to use). Part 1 of my series explains why CT exists (DigiNotar hack), how it works, and the insane scale (96M certs/week).
-
Certificate Transparency logs hold billions of certificates but searching them is brutal. crt.sh is slow, truncates results, and crashes constantly.
We built a better CT search tool at CertKit (free to use). Part 1 of my series explains why CT exists (DigiNotar hack), how it works, and the insane scale (96M certs/week).
-
First I must underline that this is all speculation and I have no proof of the attack described here being implemented in practice.
I firmly believe too much trust is placed on the effectiveness of certificate transparency to protect against state actors.
Much focus has been placed on the fact that certificate transparency is supposedly geographically and jurisdictionally distributed and could not be defeated by a single state. Unfortunately, the monoculture of Chromium-based browsers means that a single point of failure now exists, easily tampered with by a single jurisdiction: the USA.
From checking I've done so far, it seems that most Chromium-based browsers use the Google-generated "PKI Metadata" package as is. This would include browsers such as:
- Google Chrome
- Microsoft Edge
- Vivaldi Browser
- Brave BrowserAssuming the actor would have ability to sign malicious "PKI Metadata" update, this would mean that the actor would also have the ability to disable certificate transparency by targeting the periodic "PKI Metadata" update performed by the Chromium component updater.
In practice the attack would replace the "ct_config.pb" file with one that lists fake servers that are all in control of the attacker and that would provide a fake Merkle tree against which a crafted certificate would then validate. No collusion by the CT log providers are required as the actual list is replaced by malicious one. Once done, the actor who has the ability to issue otherwise trusted certificates can bypass certificate transparency and quietly get MiTM performed. In effect, CT validation would still happen, but it would be performed against infrastructure fully controlled by the attacker. Notably to implement this attack no changes to Chromium source code or binaries would be required, only the component updater signing key would need to be made available to the actor.
I am not claiming that Google would necessarily be doing something like this, or that they would be doing this willingly. The United States law, however, has binding clauses that require US companies to cooperate to provide lawful access. Notably, this law also specifically only protects US citizens, and everyone else can be targeted freely. This is why Certificate Transparency was planned to be distributed between multiple jurisdictions to begin with.
Apple and Mozilla manage their certificate transparency log lists separately. Thus, they're outside of this single point of failure, at least. This doesn't necessarily mean they would be unaffected by similar lawful access requirements, however.
Having laid out the problem, is there anything that could be done to improve the situation? What should parties using Chromium do to rectify this situation and limit the potential impact from such malicious "PKI Metadata" updates?
I suggest that browser manufacturers that take security seriously stop blindly trusting Google to deliver "PKI Metadata" updates. Rather, they should set up infrastructure of their own that delivers this (and potentially other?) component updates. The service would then add an extra layer of validation, where the Google-provided update is verified (by automation and potentially manual means) before being repackaged and signed with their own trust root.
Of course, this method isn't bulletproof either, as these individual signing parties could then be targeted by the state actor. However, it would be a far better situation than trusting a single company in a single jurisdiction for this certificate transparency list.
In the end you need to trust something at some point. I would like to place my trust on something else than good will of US government.
#privacy #certificatetransparency #chromium #bravebrowser #vivaldi #ctlogs
-
First I must underline that this is all speculation and I have no proof of the attack described here being implemented in practice.
I firmly believe too much trust is placed on the effectiveness of certificate transparency to protect against state actors.
Much focus has been placed on the fact that certificate transparency is supposedly geographically and jurisdictionally distributed and could not be defeated by a single state. Unfortunately, the monoculture of Chromium-based browsers means that a single point of failure now exists, easily tampered with by a single jurisdiction: the USA.
From checking I've done so far, it seems that most Chromium-based browsers use the Google-generated "PKI Metadata" package as is. This would include browsers such as:
- Google Chrome
- Microsoft Edge
- Vivaldi Browser
- Brave BrowserAssuming the actor would have ability to sign malicious "PKI Metadata" update, this would mean that the actor would also have the ability to disable certificate transparency by targeting the periodic "PKI Metadata" update performed by the Chromium component updater.
In practice the attack would replace the "ct_config.pb" file with one that lists fake servers that are all in control of the attacker and that would provide a fake Merkle tree against which a crafted certificate would then validate. No collusion by the CT log providers are required as the actual list is replaced by malicious one. Once done, the actor who has the ability to issue otherwise trusted certificates can bypass certificate transparency and quietly get MiTM performed. In effect, CT validation would still happen, but it would be performed against infrastructure fully controlled by the attacker. Notably to implement this attack no changes to Chromium source code or binaries would be required, only the component updater signing key would need to be made available to the actor.
I am not claiming that Google would necessarily be doing something like this, or that they would be doing this willingly. The United States law, however, has binding clauses that require US companies to cooperate to provide lawful access. Notably, this law also specifically only protects US citizens, and everyone else can be targeted freely. This is why Certificate Transparency was planned to be distributed between multiple jurisdictions to begin with.
Apple and Mozilla manage their certificate transparency log lists separately. Thus, they're outside of this single point of failure, at least. This doesn't necessarily mean they would be unaffected by similar lawful access requirements, however.
Having laid out the problem, is there anything that could be done to improve the situation? What should parties using Chromium do to rectify this situation and limit the potential impact from such malicious "PKI Metadata" updates?
I suggest that browser manufacturers that take security seriously stop blindly trusting Google to deliver "PKI Metadata" updates. Rather, they should set up infrastructure of their own that delivers this (and potentially other?) component updates. The service would then add an extra layer of validation, where the Google-provided update is verified (by automation and potentially manual means) before being repackaged and signed with their own trust root.
Of course, this method isn't bulletproof either, as these individual signing parties could then be targeted by the state actor. However, it would be a far better situation than trusting a single company in a single jurisdiction for this certificate transparency list.
In the end you need to trust something at some point. I would like to place my trust on something else than good will of US government.
#privacy #certificatetransparency #chromium #bravebrowser #vivaldi #ctlogs
-
#CertificateTransparency (CT) creates public, append-only logs of every TLS certificate issued, helping detect rogue or mistaken certificates.
Learn how CT has 𝐭𝐫𝐚𝐧𝐬𝐟𝐨𝐫𝐦𝐞𝐝 𝐢𝐧𝐭𝐞𝐫𝐧𝐞𝐭 𝐏𝐊𝐈: https://bit.ly/4gkK72Y
📰 Read now!
-
#CertificateTransparency (CT) creates public, append-only logs of every TLS certificate issued, helping detect rogue or mistaken certificates.
Learn how CT has 𝐭𝐫𝐚𝐧𝐬𝐟𝐨𝐫𝐦𝐞𝐝 𝐢𝐧𝐭𝐞𝐫𝐧𝐞𝐭 𝐏𝐊𝐈: https://bit.ly/4gkK72Y
📰 Read now!
-
#Heise:
"
"Passwort" Folge 40: Probleme mit Widerrufen, Verbindungsabbrüchen und anderemEine pickepackevolle Folge, gefüllt unter anderem mit kundigem Exploitbau unter Linux, einem HTTP2-DoS und millionenfachen Zertifikatsrückrufen von Microsoft.
"
https://www.heise.de/news/Passwort-Folge-40-Probleme-mit-Widerrufen-Verbindungsabbruechen-und-anderem-10632694.htmlmp3: https://audio.podigee-cdn.net/2098722-m-7a844de5c304b67bf99d2ee327d88425.mp3
10.9.2025
Aaaa.. MS..
#CA #CertificateTransparency #Chrome #LetsEncrypt #Microsoft #MS #PKI #TLSZertifikat #WebPKI #Zertifikat
-
#Heise:
"
"Passwort" Folge 40: Probleme mit Widerrufen, Verbindungsabbrüchen und anderemEine pickepackevolle Folge, gefüllt unter anderem mit kundigem Exploitbau unter Linux, einem HTTP2-DoS und millionenfachen Zertifikatsrückrufen von Microsoft.
"
https://www.heise.de/news/Passwort-Folge-40-Probleme-mit-Widerrufen-Verbindungsabbruechen-und-anderem-10632694.htmlmp3: https://audio.podigee-cdn.net/2098722-m-7a844de5c304b67bf99d2ee327d88425.mp3
10.9.2025
Aaaa.. MS..
#CA #CertificateTransparency #Chrome #LetsEncrypt #Microsoft #MS #PKI #TLSZertifikat #WebPKI #Zertifikat
-
On August 20, @letsencrypt switched certificate issuance to use intermediate certificates R12 and R13, retiring the use of R10 and R11. The shift is clearly visible in our #certificatetransparency graphs, starting ~18:00 UTC.
https://radar.cloudflare.com/certificate-transparency
https://community.letsencrypt.org/t/switching-issuance-to-new-intermediates/240073
-
On August 20, @letsencrypt switched certificate issuance to use intermediate certificates R12 and R13, retiring the use of R10 and R11. The shift is clearly visible in our #certificatetransparency graphs, starting ~18:00 UTC.
https://radar.cloudflare.com/certificate-transparency
https://community.letsencrypt.org/t/switching-issuance-to-new-intermediates/240073
-
😆 So, you're telling me that running a Certificate Transparency log is the secret sauce to keeping the web from collapsing like a poorly set-up game of Jenga? 🤔 Let's all just casually assume every basement-dweller with a homelab is itching to become the digital savior of the internet. 🏆
https://words.filippo.io/run-sunlight/ #CertificateTransparency #InternetSafety #DigitalSaviors #HomelabHeroes #WebSecurity #HackerNews #ngated -
😆 So, you're telling me that running a Certificate Transparency log is the secret sauce to keeping the web from collapsing like a poorly set-up game of Jenga? 🤔 Let's all just casually assume every basement-dweller with a homelab is itching to become the digital savior of the internet. 🏆
https://words.filippo.io/run-sunlight/ #CertificateTransparency #InternetSafety #DigitalSaviors #HomelabHeroes #WebSecurity #HackerNews #ngated -
You Should Run a Certificate Transparency Log
https://words.filippo.io/run-sunlight/
#HackerNews #CertificateTransparency #CertificateLog #Cybersecurity #WebSecurity #TLS
-
You Should Run a Certificate Transparency Log
https://words.filippo.io/run-sunlight/
#HackerNews #CertificateTransparency #CertificateLog #Cybersecurity #WebSecurity #TLS
-
Guess where the appmattus/certificatetransparency code was originally made: your favourite late-stage capitalism digital "health" (IE, death) platform provider;
To quote mattmook:
"Originally the project was born out of the company Babylon Health". -
Guess where the appmattus/certificatetransparency code was originally made: your favourite late-stage capitalism digital "health" (IE, death) platform provider;
To quote mattmook:
"Originally the project was born out of the company Babylon Health". -
I submitted a PR to fix a crash on startup for certstream-server https://github.com/CaliDog/certstream-server/pull/129 #certificatetransparency
-
I submitted a PR to fix a crash on startup for certstream-server https://github.com/CaliDog/certstream-server/pull/129 #certificatetransparency
-
Certificate Transparency in Firefox: A Big Step for Web Security — https://blog.transparency.dev/ct-in-firefox
#HackerNews #CertificateTransparency #Firefox #WebSecurity #CyberSecurity #TechNews -
Certificate Transparency in Firefox: A Big Step for Web Security — https://blog.transparency.dev/ct-in-firefox
#HackerNews #CertificateTransparency #Firefox #WebSecurity #CyberSecurity #TechNews -
Furthermore produced software artifacts proofs are written into a database similar to #certificateTransparency.
We have recently implemented this in #PrivateBin and it works great: https://github.com/PrivateBin/PrivateBin/issues/1169
Of course practically, people (especially software consumers) needed to verify it, to be worth the work.
Obviously, it's no magic bullet. It just raises the burden for an attacker. Obviously, the source code repo could be made to contain bad code, but you cannot anymore tamper at built-time.
-
Furthermore produced software artifacts proofs are written into a database similar to #certificateTransparency.
We have recently implemented this in #PrivateBin and it works great: https://github.com/PrivateBin/PrivateBin/issues/1169
Of course practically, people (especially software consumers) needed to verify it, to be worth the work.
Obviously, it's no magic bullet. It just raises the burden for an attacker. Obviously, the source code repo could be made to contain bad code, but you cannot anymore tamper at built-time.
-
Anyone else just getting 502s when using crt.sh, searching for CT logs on domain names?
The index page works, although I'd argue with degraded performance. Any search on the site however does not.
Can someone confirm? Or is it just me?
-
Anyone else just getting 502s when using crt.sh, searching for CT logs on domain names?
The index page works, although I'd argue with degraded performance. Any search on the site however does not.
Can someone confirm? Or is it just me?
-
Filippo has announced the #Sunlight #CertificateTransparency log design on ct-policy #CT https://groups.google.com/a/chromium.org/g/ct-policy/c/v9JzlbphYBs/m/kyQk4ZP6AAAJ
Let's Encrypt has also announced adopting Sunlight for new logs that we hope will be more scalable and dramatically less expensive: Sycamore, Willow, and our new test log, Twig: https://letsencrypt.org/2024/03/14/introducing-sunlight
-
I'll be attending the Real World Crypto Symposium in Toronto in two weeks time (#RWC), and after that, I'm once again co-organizing the Open Source Cryptography Workshop. (#OSCW2024)
I’ll also be real happy to talk about the new developments with the #Sunlight #CertificateTransparency log design, Let’s Encrypt’s new ACME Renewal Information (#ARI) draft specification, #CRLite, Rustls… all that stuff.
-
The Internet Last Week
* DigitalOcean services disruption
https://status.digitalocean.com/incidents/33vqf05m8396
* T-Mobile account services outage
https://www.bleepingcomputer.com/news/technology/major-t-mobile-outage-takes-down-account-access-mobile-app/
* US weather-related service disruptions
https://bfs.llc/@PowerOutageUS/111728282761278973
* Mammoth2024h1 CT logging resource-related disruption
https://groups.google.com/a/chromium.org/g/ct-policy/c/038B7F4g8cU
https://groups.google.com/a/chromium.org/g/ct-policy/c/_dhkSzwoZuE#DigitalOcean #TMobile #Weather #Outage #CertificateTransparency
-
@mmeier And for anyone who wants to move away from wildcard certs and use actual hostnames, just be aware of #certificatetransparency . While it's overall a healthy thing for the internet, you could end up giving any would-be attacker a list of subdomains in your #homelab.
-
@mmeier And for anyone who wants to move away from wildcard certs and use actual hostnames, just be aware of #certificatetransparency . While it's overall a healthy thing for the internet, you could end up giving any would-be attacker a list of subdomains in your #homelab.
-
Recently I was digging in the outliers of DNS resolving from the certificate transparency and there is a hostname which is often hardcoded
test.microsoftpki.netbut which is giving aNXDOMAIN. Checking the Passive DNS, the domain itself exists and seems to be registered on Microsoft infrastructureAny clue of the software or service at Microsoft generating certificate with an invalid domain for testing?
-
Recently I was digging in the outliers of DNS resolving from the certificate transparency and there is a hostname which is often hardcoded
test.microsoftpki.netbut which is giving aNXDOMAIN. Checking the Passive DNS, the domain itself exists and seems to be registered on Microsoft infrastructureAny clue of the software or service at Microsoft generating certificate with an invalid domain for testing?
-
Weekend Reads:
* OpenPGP for app devs book https://openpgp.dev/book/
* Nagios XI vulnerabilities https://research.nccgroup.com/2023/12/13/technical-advisory-multiple-vulnerabilities-in-nagios-xi/
* Metro area network trends https://www.researchgate.net/publication/376111355_A_survey_of_trends_and_motivations_regarding_Communication_Service_Providers'_metro_area_network_implementations
* Certificate transparency systems https://educatedguesswork.org/posts/transparency-part-1/
* Tracking device anti-stalking analysis https://arxiv.org/abs/2312.07157 -
Weekend Reads:
* OpenPGP for app devs book https://openpgp.dev/book/
* Nagios XI vulnerabilities https://research.nccgroup.com/2023/12/13/technical-advisory-multiple-vulnerabilities-in-nagios-xi/
* Metro area network trends https://www.researchgate.net/publication/376111355_A_survey_of_trends_and_motivations_regarding_Communication_Service_Providers'_metro_area_network_implementations
* Certificate transparency systems https://educatedguesswork.org/posts/transparency-part-1/
* Tracking device anti-stalking analysis https://arxiv.org/abs/2312.07157 -
The #EU has reached an agreement on #eIDAS, rolling back the state of Internet security by 12 years, and by forcing browser vendors / root store operators to include government Root CA, disallowing #CertificateTransparency and making it illegal to fix (unless you can influence #ETSI, which is conveniently government friendly when it comes to surveillance).
This is bad. Really bad. It enables surveillance.
Technical background: https://scotthelme.co.uk/what-the-qwac/
-
The #EU has reached an agreement on #eIDAS, rolling back the state of Internet security by 12 years, and by forcing browser vendors / root store operators to include government Root CA, disallowing #CertificateTransparency and making it illegal to fix (unless you can influence #ETSI, which is conveniently government friendly when it comes to surveillance).
This is bad. Really bad. It enables surveillance.
Technical background: https://scotthelme.co.uk/what-the-qwac/
-
@realramnit Wobei das Risiko in Zeiten von #CertificateTransparency und CAA-Records geringer geworden ist als anno dazumal. Will sagen, auf diese Weise zu schnorcheln würde eigentlich auffallen.
(Übrigens gibt es eine ganze Reihe von CAs, von denen man sich fragt, warum Browser die für alle und nicht wenigstens nur eingeschränkt auf manche TLDs akzeptieren.)
-
@jabberati @jssfr @aslmx @debacle Thank you for complaining! I had no idea #Cloudflare did this. I have many of my corporate clients on there. I’ll have to pay more attention to https://crt.sh #CertificateTransparency