Lightning Talk: Move Over Certificate Pinning. Certificate Transparency is Here!
summary
Certificate Transparency replaces brittle certificate pinning by requiring CAs to publish every new cert to public, cryptographically append-only Merkle tree logs so outsiders can spot rogue issuances; the 2011 actor that enabled a five‑week Google MITM would have been detectable within hours. Logs return a signed certificate timestamp embedded in the cert; clients verify it during the TLS handshake. iOS support needs one line of code; Android historically lacked a good option so an open‑source Android library implements CT verification by accepting a domain name rather than pins.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:25How HTTPS trust works
- 3:11Weaknesses in certificate authorities
- 3:31Certificate pinning explained
- 4:57Problems with certificate pinning
- 5:59Why certificate transparency
- 7:01How certificate transparency works
- 8:48Real-world examples
- 10:35Client verification methods
- 11:39Implementing on mobile
- 12:00Conclusion and Q&A
related talks
08mMove over certificate pinning. Certificate transparency is here!
51mCertificate Transparency Logs: Roadmaps to Riches or Ruin?
25mHow SSL Pinning Reinforces iOS App Security
33mCats? In My Certificate Transparency Logs?
20mTrust Agility in an Era of Transient Ties: Rethinking TLS...
46mSelf-Signed, Why Not! Exploiting Insecure Certificate Validation In iOS And macOS
26mFrom HTTPS Basics to Network Security Configuration
28mTrustBase: An Architecture to Repair and Strengthen...