Certificate transparency

Certificate Transparency (CT) is an experimental IETF open standard and open source framework for monitoring and auditing digital certificates. Through a system of certificate logs, monitors, and auditors, certificate transparency allows website users and domain owners to identify mistakenly or maliciously issued certificates and to identify certificate authorities (CAs) that have gone rogue.

Flaws in the current system of digital certificate management were made evident in high-profile security and privacy breaches caused by fraudulent certificates.

In 2011 Dutch certificate authority DigiNotar filed for bankruptcy after intruders successfully created more than 500 fraudulent digital certificates using its infrastructure.

Ben Laurie and Adam Langley conceived Certificate Transparency and an implementation of the framework was developed as an open source project.

One of the problems with digital certificate management is that fraudulent certificates take a long time to be spotted, reported and revoked by the browser vendors. Certificate Transparency would help by making it impossible for a certificate to be issued for a domain without the domain owner knowing.

Certificate Transparency does not require side channel communication to validate certificates as do some competing technologies such as (OCSP) and Convergence. Certificate Transparency also operates without the need to trust a third party.

Certificate Transparency depends on verifiable Certificate Transparency logs. A log appends new certificates to an ever-growing Merkle hash tree. To be seen as behaving correctly, a log must:

A log may accept certificates that are not yet fully valid and certificates that have expired.

Monitors act as clients to the log servers. Monitors check logs to make sure they are behaving correctly. An inconsistency is used to prove that a log has not behaved correctly, and the signatures on the log's data structure (the Merkle tree) prevent the log from denying that misbehavior.

...
Wikipedia