Post by @kuberoot@discuss.tchncs.de

@kuberoot@discuss.tchncs.de

2026-10-22 23:30 UTC

Okay, but how do you verify that? In order to check if the certificate was logged, you need to access the log; if somebody can fake certificates and intercept your requests, can they also impersonate the certificate log and fake an entry there? Or is it secured in some additional way?

Replies (1)

@chaospatterns@lemmy.world 2026-10-23 00:18

WebPKI (the term for certificates used for web browser as opposed to the general usage of certificates outside of the web) requires that all certificates now be included in a public, widely used certificate transparency log. That fact gets included in the certificate delivered to your browser. Your browser will reject any certificate* that was not included in a certificate transparency log. Take your instance discuss.tchncs.de for example, we can see all the certificates here. If you looked at that list, do you see anything wrong? But you’re on to something. A malicious certificate is minted and it’s in the CT log, so what? I don’t check the CT log every time I go to a new webpage. Instead, CT logs are more able giving information to security organizations and companies to detect violations under their own properties. A company like amazon or google would setup CT log monitors to continually monitor for certificates issued for their domains. If they detect one, they can flag it to the cert authority board and it can get CAs pulled from the root trust stores. I can (and probably should find time to) setup certspotter on my own domains.

Open ##5205990