- CT logs provide access to certificate and issuer\ninformation.<\/strong> You can check any domain\u2019s certificate issuer, location of the\nCA, issuance and expiry dates of an SSL certificate, subdomain coverage,\nhistory of all the previous certificates, and other important details in CT\nlogs. <\/li><\/ul>\n\n\n\n
- CT logs are append-only databases.<\/strong> This\nmeans that whenever a CA logs a certificate\u2019s details, it\u2019s added to the\ndatabase as a new record. The older records can’t be deleted, updated, or\noverwritten with newly changed data. This helps to prevent tampering issues.<\/li><\/ul>\n\n\n\n
- Records are cryptographically assured.<\/strong>\nCertificate transparency logs use Merkle tree hashes, which is a robust\ncryptographic technology that prevents tampering.<\/li><\/ul>\n\n\n\n
Why Are Certificate Transparency Logs Necessary?<\/h2>\n\n\n\n
The need for certificate transparency logs is increasingly\nimportant as cyber attackers seek to find new ways to exploit any loopholes that\nexist in current SSL\/TLS certificate technology.<\/p>\n\n\n\n
There are dozens of certificate authorities in the market.\nAny CA can issue an SSL certificate for any website on the internet. If a\ncertificate authority\u2019s private key is stolen, the attacker can issue the SSL\ncertificate containing any website\u2019s private keys and attach it to their own\nserver\u2019s private keys! They can send, receive, decrypt, and steal the data\nimpersonating the original website. Neither the website visitor’s browser nor\nthe website owner would even suspect that anything is wrong until it\u2019s too\nlate. <\/p>\n\n\n\n
Publicly trusted CAs safely store their keys on a hardware\nsecurity module (HSM), which is kept offline. \nHowever, there have been a few times when CAs’ keys were stolen and\nmisused by cybercriminals. <\/p>\n\n\n\n
Examples of Why Certificate Transparency Matters<\/h3>\n\n\n\n
We\u2019ve put together a two examples of the most notable\nincidents involving stolen and misused SSL\/TLS certificates:<\/p>\n\n\n\n
The first example took place in August 2011. An Iranian\nattacker hacked Dutch certificate authority DigiNotar and issued\na fraudulent certificate<\/a> for google.com and all its subdomains. This attack\nprimarily affected Iranian Gmail users. The good news for Google Chrome users?\nThe browser was able to detect the phony certificate and shield users from it. <\/p>\n\n\n\n
The second example we\u2019ll share occurred in March 2011. An Iranian\nattacker hacked the certificate authority (then called Comodo CA<\/a>) via\ninstantssl.com and issued himself\ncertificates<\/a> for some notable websites, including Gmail, Hotmail, and Yahoo\nMail.<\/p>\n\n\n\n
As you can see, the faulty issuance of an SSL certificate\ncan have dire consequences. CT logs can\u2019t prevent the mis-issuance the SSL\ncertificates. But if any suspicious certificate has been issued, a CT log\u2019s\nmonitors and auditors can quickly detect and revoke the certificate to minimize\ndamage at the earliest stage. <\/p>\n\n\n\n
Who Runs the Certificate Transparency Logs? <\/h2>\n\n\n\n
Currently, Google is running multiple certificate\ntransparency logs through its Certificate Transparency\nProject<\/a>. The goal of this initiative is to \u201csafeguard the certificate\nissuance process by providing an open framework for monitoring and auditing\nHTTPS certificates.\u201d Their website indicates that more than 8.2 billion entries\nhave been made to the CT logs that they monitor! <\/p>\n\n\n\n
The purpose of monitoring and auditing is to protect the\nintegrity of the certificate transparency logs. In general, certificate\nmonitors fall under the responsibilities of the CAs, whereas auditors are\noperated by the browsers. They continuously keep an eye on unauthorized\ncertificates, unusual certificate extensions, or certificates with unusual\npowers.<\/p>\n\n\n\n
How Do CT Logs Work?<\/h2>\n\n\n\n
Let\u2019s dive into how certificate\ntransparency logs work<\/a> at a basic level. Anyone can submit a certificate to\nthe log. However, if you\u2019re a website owner or website visitor, it\u2019s not your\njob to add your certificate details to CT logs. This task is typically left to\nthe CAs and server operators.<\/p>\n\n\n\n
Your CA should submit an SSL certificate to the CT logs and\nembed a signed certificate timestamp (SCT) in the certificate before sending it\nto you. SCT is the assurance that the log servers will add the certificate to\nthe CT logs within a specific time period. (In a way, an SCT is like a\nlearner\u2019s permit \u2014 a temporary document you can use until you get the real driver\u2019s\nlicense). When the browsers try to verify the SSL certificate during the TLS\nhandshake process, the SCT is also presented with the certificate, so that the\nbrowsers don\u2019t block the certificate or show an error message. The SCT is\ndelivered through an X.509v3 extension, TLS extension or OCSP stapling. <\/p>\n\n\n\n
Check out the diagram below to get a clear idea on how SCT delivering process works and compare it with the current TLS\/SSL system (i.e. when there are no SCT initiated)<\/p>\n\n\n\n
![\"Certificate](\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\")
<\/figure>\n\n\n\nDiagram courtesy of certificate-transparency.org<\/a><\/p>\n\n\n\n
If you want to check any website\u2019s CT logs, simply go to\nGoogle\u2019s Transparency\nReport page<\/a> and write down the domain name in the \u201cSearch certificates by\nhostname\u201d field.<\/p>\n\n\n\n
What If My Certificate Authority Hasn\u2019t Logged My Certificate\u2019s Information\nin CT Logs?<\/h2>\n\n\n\n
If the CA accidentally or intentionally doesn’t record the information about your domain’s SSL certificate in CT logs, no browsers would trust your website’s SSL certificate. As a result, all the browsers will show the dreaded “Your Connection Is Not Private” page with the “ERR_CERTIFICATE_TRANSPARENCY_REQUIRED<\/a>\u201d error message displayed on it (much like how the screenshot below looks): <\/p>\n\n\n\n
<\/figure>\n\n\n\nTo bypass the error page, users must manually click on the Accept Risk<\/strong> tab every time they visit your website, which can drastically affect your website traffic and business in a negative way. If you see \u201cERR_CERTIFICATE_TRANSPARENCY_REQUIRED<\/a>\u201d error on your website, immediately contact your CA and ask them to log your certificate\u2019s details in CT logs. <\/p>\n\n\n\n
Reputable CAs are not negligent and are very careful to ensure that every certificate is carefully logged in one of the certificate transparency logs. DigiCert is considered one of the top CAs in the industry. We strongly recommend you using SSL\/TLS certificates from DigiCert or one of its subsidiaries (such as RapidSSL, Symantec, GeoTrust, and Thawte), which start as low as $12.42 per year<\/a>, to avoid such risks of omittance. <\/p>\n\n\n\n
<\/p>\n\n\n\n
Save Up to 82% on SSL Certificates from RapidSSLonline!<\/h2>\n
Protect your website with an SSL Certificate from brands like RapidSSL, Symantec, GeoTrust, and Thawte.<\/p>\n
- Records are cryptographically assured.<\/strong>\nCertificate transparency logs use Merkle tree hashes, which is a robust\ncryptographic technology that prevents tampering.<\/li><\/ul>\n\n\n\n
- CT logs are append-only databases.<\/strong> This\nmeans that whenever a CA logs a certificate\u2019s details, it\u2019s added to the\ndatabase as a new record. The older records can’t be deleted, updated, or\noverwritten with newly changed data. This helps to prevent tampering issues.<\/li><\/ul>\n\n\n\n
![\"Certificate](\"https:\/\/www.rapidsslonline.com\/ssl\/wp-content\/uploads\/2020\/03\/image-5.png\")
<\/figure>\n\n\n\n![\"ERR_CERTIFICATE_TRANSPARENCY_REQUIRED\"](\"https:\/\/www.rapidsslonline.com\/ssl\/wp-content\/uploads\/2020\/03\/image-6.png\")
<\/figure>\n\n\n\n