Blogs›IBM›Certificate Transparency Implementation

Certificate Transparency Implementation

posts

2020

This post introduces Certificate Transparency (CT) as a mechanism to protect domains from mis-issued certificates by Certificate Authorities (CAs). It explains that CT relies on Merkle Trees to log issued certificates, allowing for integrity verification and immediate alerting of domain owners to mis-issuance or CA compromise. The post details implementation steps for web and mobile app developers, noting that modern browsers enforce CT. For web apps, no extra implementation is needed beyond ensuring the CA logs certificates. For mobile apps, it outlines client-side checks, including default enforcement on newer iOS versions and the use of a third-party library for Android. Server-side CT requires a valid Server Certificate Timestamp (SCT) from the CA.

2020

Certificate transparency for web and mobile apps

9/13/2020

Introduces Certificate Transparency (CT) as a security measure against mis-issued certificates. Explains the underlying Merkle Tree data structure used in CT logs. Provides guidance for web app developers on verifying CT compliance using browser developer tools. For mobile app developers, it details client-side CT checks, including specific instructions for iOS (Info.plist modification for older versions) and Android (using the `certificate-transparency-android` library with OkHttpClient). It also emphasizes the server-side requirement of a valid Server Certificate Timestamp (SCT).