Certificate transparency for web and mobile apps
Sep 13, 2020Srihari Kulkarni
Summary
This post details the implementation of Certificate Transparency (CT) for web and mobile applications. It explains the core concept of CT using Merkle Trees, outlines actions for web developers (relying on browser enforcement and providing verification steps), and provides specific guidance for mobile developers. For iOS, it notes default enforcement and a plist option for older versions. For Android, it introduces the `certificate-transparency-android` library and demonstrates its integration with OkHttpClient for client-side checks. It also reiterates the server-side requirement of valid SCTs.