Certificate transparency

As explained in Real-World Cryptography

Certificate Transparency is a system that publicly logs issued digital certificates and provides proofs that certificates appear in those logs.

A misbehaving certificate authority could issue a malicious certificate and avoid revoking it. Certificate Transparency counters this by requiring issued certificates to appear in public logs, with proofs that browsers can check. section 9.3

The protection works as a monitoring-and-response loop:

• Certificate authorities add every issued certificate to a public log. section 9.3
• Browsers such as Chrome reject certificates lacking proofs of inclusion in a public log. section 9.3
• Domain owners monitor logs for unexpected certificates and ask certificate authorities to revoke them quickly. section 9.3

Spotting an unauthorized certificate

If a domain owner finds a certificate for their domain that they never requested, the public log exposes the mistake after issuance, enabling investigation and revocation. section 9.3

Figure 9.9 Certificate revocation on the web has had three popular solutions: Certificate Revocation Lists (CRLs), Online Certificate Status Protocol (OCSP), and OCSP stapling.

Compare Certificate Transparency with certificate revocation lists, OCSP, and OCSP stapling—the other prominent web revocation approaches. section 9.3

How Real-World Cryptography covers it

How deep it goes

Explains public logs, inclusion proofs, monitoring, and revocation, while noting dependence on detection after issuance.

Examples

Uses unauthorized certificates for a domain and compares CRLs, OCSP, and OCSP stapling.

What it assumes

Assumes basic familiarity with digital certificates, certificate authorities, browsers, and certificate revocation.

What you can do after

Diagnose unexpected domain certificates through public logs and trigger rapid certificate revocation.

How it connects

Connects certificate authorities, certificate revocation, OCSP, certificate pinning, public key pinning, and browser trust stores.

liveBookmanning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Related concepts

• certification authorityaddresses · A certification authority is a trusted entity that verifies identities and issues digitally signed certificates binding public keys to identities or domains.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.