News for hackers. Stuff that matters.

A comment on Show HN: CertStream – See SSL certs as they're issued in real time. Parent comment

Re:Show HN: CertStream – See SSL certs as they're issued in ... by y0ghur7_xxx on Friday November 03, 2017 @07:34PM (#15622961)
> How can they efficiently do that?

The web server sends a Signed Certificate Timestamp in the TLS Handshake¹. The browser will check that.

Apache support is coming², and other web server vendors are probably working on it as well.

¹https://tools.ietf.org/html/rfc6962#page-13

²https://httpd.apache.org/docs/trunk/mod/mod_ssl_ct.html

[ Parent | on HN ]
Re:Show HN: CertStream – See SSL certs as they're issued in ... by prdonahue on Friday November 03, 2017 @09:38PM (#15623386)
Even better is embedding the SCTs in the x509 structure itself so that you don't have to rely on obtaining/caching and the sending in the handshake. (Yes, there's some cases where a policy change my require the addition of additional SCTs—or different ones altogether—but this should be the exception not the norm.)
[ Parent | on HN ]