Documentation
¶
Overview ¶
Package ct monitors Certificate Transparency for watched domains through CT search services (Cert Spotter, crt.sh). It never mirrors CT logs: only issuances matching watched names are fetched and stored.
Index ¶
- Constants
- Variables
- func AutoWatch(ctx context.Context, db *database.DB, idx *database.CertIndex) (int, error)
- func Classify(is Issuance, idx *database.CertIndex, seenIssuers map[string]bool, ...) (status, reason, certID string)
- func NormalizePattern(p string, subdomains bool) (string, bool, error)
- type CertSpotter
- type CheckResult
- type Checker
- type CrtSh
- type Issuance
- type Provider
- type Query
Constants ¶
const ( StatusKnown = "known" // the certificate or its key is in the inventory StatusNew = "new" // not in the inventory, from an issuer already used for these names StatusChanged = "changed" // same names as a stored certificate, different certificate StatusUnexpected = "unexpected" // not in the inventory and from an issuer not seen before StatusExpired = "expired" )
Observation statuses. Unknown certificates are never called malicious: "unexpected" only means the issuance does not fit what is known.
Variables ¶
var ErrNoWatches = errors.New("no CT watches configured; add one with 'sslknife ct watch example.com'")
ErrNoWatches is returned by commands when nothing is watched.
var ErrNotWatched = errors.New("domain is not watched")
ErrNotWatched is returned when a domain filter matches no watch.
var ErrRateLimited = errors.New("CT provider rate limit reached; try again later")
ErrRateLimited is returned when the service asks us to slow down.
Functions ¶
func AutoWatch ¶
AutoWatch adds watches for DNS SANs of stored certificates (wildcards become subdomain watches). It returns the number of watches added.
Types ¶
type CertSpotter ¶
type CertSpotter struct {
Client *http.Client
Token string // optional API key; raises the rate limit
BaseURL string
MaxPages int
}
CertSpotter queries SSLMate's Cert Spotter API, which de-duplicates precertificates and supports incremental polling with "after".
func (*CertSpotter) Name ¶
func (*CertSpotter) Name() string
type CheckResult ¶
type CheckResult struct {
Watch database.CTWatch `json:"-"`
Pattern string `json:"watch"`
Fetched int `json:"fetched"`
Added []database.CTObservation `json:"new_observations"`
Error string `json:"error,omitempty"`
}
CheckResult reports one watch poll.
func RunAll ¶
func RunAll(ctx context.Context, db *database.DB, chk *Checker, domain string, autoWatch bool) ([]CheckResult, int, error)
RunAll polls every watch (or those for domain), optionally adding watches for stored certificate names first. It returns the per-watch results and the number of watches added automatically.
type CrtSh ¶
CrtSh queries crt.sh. It has no incremental cursor; results are de-duplicated by issuer and serial number.
type Issuance ¶
type Issuance struct {
Provider string `json:"provider"`
ID string `json:"id"`
Identity string `json:"identity"` // de-duplicates precertificate/certificate pairs
CertSHA256 string `json:"cert_sha256,omitempty"`
PubkeySHA256 string `json:"pubkey_sha256,omitempty"`
Serial string `json:"serial,omitempty"`
Issuer string `json:"issuer"`
IssuerName string `json:"issuer_name,omitempty"`
DNSNames []string `json:"dns_names"`
NotBefore time.Time `json:"not_before"`
NotAfter time.Time `json:"not_after"`
Revoked *bool `json:"revoked,omitempty"`
}
Issuance is one certificate (or precertificate) found in CT.
Source Files