ct

package

v0.3.1 Latest Latest Go to latest Published: Feb 20, 2026 License: MIT Imports: 9 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/ppiankov/trustwatch

Links

Open Source Insights

Documentation ¶

Overview ¶

Package ct provides Certificate Transparency log monitoring via crt.sh.

Index ¶

Constants
func Check(entries []Entry, knownSerials map[string]bool, allowedIssuers []string) []store.CertFinding
func WithBaseURL(u string) func(*Client)
type Client
- func NewClient(opts ...func(*Client)) *Client
- func (c *Client) FetchCerts(ctx context.Context, domain string) ([]Entry, error)
type Entry

Constants ¶

View Source

const (
	// FindingCTUnknown indicates a certificate in CT logs not found in the cluster.
	FindingCTUnknown = "CT_UNKNOWN_CERT"
	// FindingCTRogue indicates a certificate issued by an unexpected CA.
	FindingCTRogue = "CT_ROGUE_ISSUER"
)

Variables ¶

This section is empty.

Functions ¶

func Check ¶

func Check(entries []Entry, knownSerials map[string]bool, allowedIssuers []string) []store.CertFinding

Check compares CT log entries against known cluster serials and allowed issuers. Returns findings for unknown certs and rogue issuers.

func WithBaseURL ¶

func WithBaseURL(u string) func(*Client)

WithBaseURL overrides the crt.sh base URL (for testing).

Types ¶

type Client ¶

type Client struct {
	// contains filtered or unexported fields
}

Client queries crt.sh for CT log entries.

func NewClient ¶

func NewClient(opts ...func(*Client)) *Client

NewClient creates a CT log client. Options can override baseURL for testing.

func (*Client) FetchCerts ¶

func (c *Client) FetchCerts(ctx context.Context, domain string) ([]Entry, error)

FetchCerts queries crt.sh for certificates matching the given domain. Returns deduplicated entries by serial number.

type Entry ¶

type Entry struct {
	SerialNumber string `json:"serial_number"`
	CommonName   string `json:"common_name"`
	NameValue    string `json:"name_value"`
	IssuerName   string `json:"issuer_name"`
	NotBefore    string `json:"not_before"`
	NotAfter     string `json:"not_after"`
	ID           int64  `json:"id"`
}

Entry represents a certificate record from crt.sh.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL