Certificate Transparency Logs: Roadmaps to Riches or Ruin?
summary
Certificate Transparency logs prove and record every issued certificate by publishing pre-certificates to public, append-only Merkle trees, letting defenders detect fraud quickly. Real incidents include 531 rogue certificates from DigiNotar (fraudulently issued July 10, discovered later), revocation lag on August 29, and industry responses. Tooling shown: crt.sh, Cert Spotter, Calidog CT stream, and TeapotCE honeypots; a live demo issues a Let’s Encrypt cert for a honeypot domain and observes thousands of scans — Let's Encrypt: 5–6M certs/day — while CT logs are append-only Merkle trees.
AI-written summary · about
chapters (9)
- 0:00Introduction and welcome
- 1:06SSL certificate types overview
- 11:03History of certificate breaches
- 23:30DigiNotar breach deep dive
- 33:28Need for Certificate Transparency logs
- 36:20How CT logs work
- 40:14Live demo request and monitor
- 48:54Blue team defense strategies
- 50:20Q&A and closing remarks
related talks
13mLightning Talk: Move Over Certificate Pinning. Certificate Transparency is Here!
33mCats? In My Certificate Transparency Logs?
35mTrust Unearned? Evaluating CA Trustworthiness Across 5 Billion Certificates
08mMove over certificate pinning. Certificate transparency is here!
30mTrust Engineering: Building Security Leadership at Early-Stage...
30mHashiTLS: Demystifying Security Certs
06mKeynote: Ten Years as a Free, Open, and Automated Certificate Authority
23mBamboozling Certificate Authorities with BGP